Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41 results
Oct 15, 2026XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController).CVE-2026-106708 · Other software · reported by MITREHigh 8.8
XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog).CVE-2026-106707 · Other software · reported by MITREMedium 5.4
XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST /jobinfo/trigger.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor.CVE-2026-106706 · Other software · reported by MITREMedium 5.4
XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoControlleCVE-2026-107779 · Other software · dromara · reported by VulnCheckCritical 9.3
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.
- Product
- skyeye
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026A vulnerability was determined in xuxueli xxl-job up to 3.5.0.CVE-2026-94426 · Other software · xuxueli · reported by VulDBLow 2
A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0.CVE-2026-94145 · Other software · xuxueli · reported by VulDBLow 2
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/author leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2026A vulnerability was identified in Xuxueli xxl-job up to 3.5.0.CVE-2026-90489 · Other software · Xuxueli · reported by VulDBLow 2
A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2026A vulnerability was determined in Xuxueli xxl-job up to 3.4.2.CVE-2026-90488 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2026A vulnerability was found in Xuxueli xxl-job up to 3.4.2.CVE-2026-90487 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2026A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplCVE-2026-52371 · Other software · reported by MITREMedium 6.5
A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups tCVE-2026-65316 · Other software · xuxueli · reported by VulnCheckHigh 7.1
XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log records across all job groups by calling the logDetailCat endpoint with incremented logId parameter values, bypassing the permission check present in the sibling logDetailPage endpoint, and retrieve sensitive log content from restricted job groups.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicCVE-2026-26719 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modificatiCVE-2026-26718 · Other software · reported by MITRECritical 9.1
A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comxxl-job-admin.com
Apr 28, 2026A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2.CVE-2026-7306 · Other software · Xuxueli · reported by VulDBLow 2.9
A security vulnerability has been detected in Xuxueli xxl-job up to 3.3.2. The impacted element is an unknown function of the file xxl-job-admin/src/main/java/com/xxl/job/admin/scheduler/openapi/OpenApiController.java of the component OpenAPI Endpoint. Such manipulation of the argument default_token leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A weakness has been identified in Xuxueli xxl-job up to 3.3.2.CVE-2026-7305 · Other software · Xuxueli · reported by VulDBLow 2.1
A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src/main/java/com/xxl/job/admin/service/impl/XxlJobServiceImpl.java of the component trigger Endpoint. This manipulation of the argument addressList causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. There is ongoing doubt regarding the real existence of this vulnerability. The project maintainer explains (translated from Chinese): "Triggers are manually activated and involve login and access control, thus requiring management." The pull request by the researcher got rejected because of that.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2.CVE-2026-7303 · Other software · Xuxueli · reported by VulDBLow 2.9
A security flaw has been discovered in Xuxueli xxl-job up to 3.3.2. Impacted is the function logDetailCat of the file xxl-job-admin/src/main/java/com/xxl/job/admin/controller/biz/JobLogController.java of the component Execution Log Handler. The manipulation of the argument logId results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.4.0 is recommended to address this issue. The patch is identified as d24e4ccd6073cc75305e1d3b9c29bc8db7437e7a. It is suggested to upgrade the affected component.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2026A vulnerability was detected in xuxueli xxl-job up to 3.3.2.CVE-2026-3733 · Other software · xuxueli · reported by VulDBLow 2.1
A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit is now public and may be used. The project maintainer closed the issue report with the following statement: "Access token security verification is required." (translated from Chinese)
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A vulnerability was found in Xuxueli xxl-job up to 3.1.1.CVE-2025-9264 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource identifiers. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2025A vulnerability has been found in Xuxueli xxl-job up to 3.1.1.CVE-2025-9263 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic.CVE-2025-7789 · Other software · Xuxueli · reported by VulDBLow 2.9
A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with insufficient computational effort. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical.CVE-2025-7788 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2025A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1.CVE-2025-7787 · Other software · Xuxueli · reported by VulDBLow 2.1
A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2024Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.CVE-2024-42681 · Other software · xuxueli · reported by MITREHigh 8.8
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2024A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1.CVE-2024-3366 · Other software · Xuxueli · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2024xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.CVE-2024-24113 · Other software · Xuxueli · reported by MITREHigh 8.8
xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.CVE-2023-48089 · Other software · xuxueli · reported by MITREHigh 8.8
xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.
- Product
- xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.CVE-2023-48088 · Other software · Xuxueli · reported by MITREMedium 5.4
xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2023xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat.CVE-2023-48087 · Other software · Xuxueli · reported by MITREMedium 5.4
xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execute arbitrary code anCVE-2020-24922 · Other software · Xuxueli · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execute arbitrary code and esclate privileges via crafted .html file.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request tCVE-2023-33779 · Other software · Xuxueli · reported by MITREHigh 8.8
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2023This affects all versions of the package com.xuxueli:xxl-job.CVE-2023-26120 · Other software · Xuxueli · reported by report@snyk.ioMedium 5.4
This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Mar 21, 2023Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.CVE-2023-27087 · Other software · Xuxueli · reported by MITREHigh 7.5
Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2023A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1.CVE-2023-0674 · Other software · Xuxueli · reported by VulDBMedium 4.3
A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220196.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2022XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.CVE-2022-43183 · Other software · Xuxueli · reported by MITREHigh 8.8
XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.CVE-2022-40929 · Other software · Xuxueli · reported by MITRECritical 9.8
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.CVE-2022-36157 · Other software · Xuxueli · reported by MITREHigh 8.8
XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2022XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.CVE-2022-29770 · Other software · Xuxueli · reported by MITREMedium 5.4
XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.CVE-2022-29002 · Other software · Xuxueli · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2020XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.CVE-2020-29204 · Other software · Xuxueli · reported by MITREMedium 6.1
XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2020Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddreCVE-2020-23814 · Other software · Xuxueli · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2020xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.CVE-2020-23811 · Other software · Xuxueli · reported by MITREHigh 7.5
xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.
- Product
- Xxl-job
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.