Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,928 results · page 26 of 99
Jun 29, 2026Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contentsCVE-2026-57946 · Other software · iv-org · reported by VulnCheckMedium 6.3
Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers can supply a playlist ID to the feed endpoint to obtain the full playlist contents, owner email address, and associated video entries without any authentication.
- Product
- Invidious
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2026PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile inforCVE-2026-57945 · Other software · photoprism · reported by VulnCheckMedium 5.3
PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile information by sending requests to arbitrary user endpoints. Attackers can exploit the missing session-to-user identifier validation in the PUT users API endpoint to overwrite another user's profile details without authorization.
- Product
- photoprism
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2026LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant theCVE-2026-57943 · Other software · LibrePhotos · reported by VulnCheckMedium 6
LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant themselves access to other users' private photos by bypassing ownership validation. Attackers can manipulate shared_to relations without proper owner checks to read arbitrary private photos belonging to other users.
- Product
- librephotos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2026Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credCVE-2026-56783 · Other software · parseablehq · reported by VulnCheckHigh 7.1
Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credentials in cleartext due to commented-out secret-masking functionality. Any authenticated user with the GetAlert action, including low-privilege reader roles, can recover credentials and internal endpoint URLs for all configured notification targets by querying GET /api/v1/targets or related endpoints.
- Product
- parseable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2026Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions.CVE-2026-57340 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions.
- What to do
- Update the plugin to the newest version.
Jun 29, 2026Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions.CVE-2026-57339 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions.
- What to do
- Update the plugin to the newest version.
Jun 29, 2026Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions.CVE-2026-57335 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 29, 2026Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.CVE-2026-57334 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.
- What to do
- Update the plugin to the newest version.
Jun 29, 2026Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.CVE-2026-57332 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.
- What to do
- Update the plugin to the newest version.
Jun 29, 2026Subscriber Broken Access Control in MainWP <= 6.1.1 versions.CVE-2026-57327 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in MainWP <= 6.1.1 versions.
- Affected
- up to 6.1.1
- What to do
- Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 29, 2026In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference waCVE-2026-53325 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, there
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 27, 2026nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend CVE-2026-58055 · Other software · nghttp2 · reported by VulnCheckMedium 6.3
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
- Product
- nghttp2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2026Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when cCVE-2026-58053 · Other software · Gitea · reported by VulnCheckCritical 9.4
Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled.
- Product
- act_runner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 26, 2026Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custoCVE-2026-12411 · Other software · Canonical · reported by security@ubuntu.comHigh 8.4
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.
- Product
- lxd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2026Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.CVE-2026-57661 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.CVE-2026-57660 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.CVE-2026-57654 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.CVE-2026-57649 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.CVE-2026-57648 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.CVE-2026-57645 · WordPress plugins & themes · reported by PatchstackHigh 8.1
newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.CVE-2026-57640 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.CVE-2026-57632 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.CVE-2026-57622 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.CVE-2026-57430 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.CVE-2026-57324 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.CVE-2026-57323 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.CVE-2026-56063 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.CVE-2026-56061 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.CVE-2026-56029 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.CVE-2026-56025 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.CVE-2026-54847 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.CVE-2026-54846 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.CVE-2026-54840 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.CVE-2026-54837 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.CVE-2026-54835 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.CVE-2026-54832 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.CVE-2026-52701 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.CVE-2026-24547 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.
- What to do
- Update the plugin to the newest version.
Jun 26, 2026Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.CVE-2025-64636 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.CVE-2025-63079 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.
- Affected
- up to 1.5.3
- What to do
- Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.CVE-2025-63078 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.
- Affected
- up to 2.4.11
- What to do
- Affects up to 2.4.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 26, 2026Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.CVE-2025-63041 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 25, 2026Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from theCVE-2026-9222 · Other software · Shenzhen i365-Tech Co. Ltd. · reported by ics-cert@hq.dhs.govCritical 9.2
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access.
- Product
- Setracker2 Parental Control App (Android) package com.tgelec.setracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.com
Jun 25, 2026Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keyCVE-2026-9220 · Other software · Shenzhen i365-Tech Co. Ltd. · reported by ics-cert@hq.dhs.govHigh 8.7
Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and its backend with static hardcoded AES keys and initialization vectors. This allows an attacker to decrypt Setracker2 watch traffic.
- Product
- Setracker2 Parental Control App (Android) package com.tgelec.setracker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.com
Jun 25, 2026The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2CVE-2026-6330 · Other software · wolfSSL · reported by facts@wolfssl.comMedium 6.3
The ML-KEM ARM64 NEON ciphertext comparison only compares half of the input, breaking the Fujisaki-Okamoto transform's implicit rejection and weakening IND-CCA2 security on that code path. The constant-time comparison effectively ignored part of the re-encrypted ciphertext, so a decapsulating party could fail to detect a manipulated ciphertext and proceed without the standard's required implicit rejection.
- Product
- wolfSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted.CVE-2026-6329 · Other software · wolfSSL · reported by facts@wolfssl.comMedium 6
PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity check on the MAC and allowing a mismatched MAC to be accepted. The PKCS#12 verify path compared the locally computed HMAC against the MAC parsed from the PKCS#12 structure using a length taken directly from the attacker-supplied input, without first verifying that it equals the length of the digest actually produced by the configured algorithm. A truncated or zero-length stored MAC could therefore be accepted, defeating the integrity protection of the MAC.
- Product
- wolfSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifieCVE-2026-54479 · Other software · EVoke · reported by ics-cert@hq.dhs.govMedium 6.9
The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend with valid session requests.
- Product
- EVoke CSMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevokesystems.comgithub.com
Jun 25, 2026Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password.CVE-2025-71335 · Other software · Flowise · reported by VulnCheckHigh 8.6
Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of the password change.
- Product
- Flowise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Jun 25, 2026Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled valuCVE-2026-57522 · Other software · bitwarden · reported by VulnCheckLow 2.3
Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing dataCVE-2026-57521 · Other software · bitwarden · reported by VulnCheckMedium 5.3
Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target organization's real customer and subscription data.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.