What’s being exploited now
Recent public advisories that name website software our review recognizes. Each line links to the source. It describes the software, never any particular site, and it is not a report about yours.
2026-11-12
Canadian Centre for Cyber Security
Canadian Centre for Cyber Security published an advisory on 2026-11-12 that names React.
https://cyber.gc.ca/en/alerts-advisories/react-security-advisory-av26-1152
2026-11-11
Drupal contributed-module security advisories
Mollie for Drupal - Moderately critical - Information disclosure - SA-CONTRIB-2026-329 (drupal.org, CC BY-SA 2.0)
2026-11-11
Drupal contributed-module security advisories
Mollie for Drupal - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-328 (drupal.org, CC BY-SA 2.0)
2026-11-04
Drupal contributed-module security advisories
REST & JSON API Authentication for Drupal - Critical - Access bypass - SA-CONTRIB-2026-298 (drupal.org, CC BY-SA 2.0)
2026-11-04
Drupal contributed-module security advisories
GroupEx PRO ( Daxko ) integration - Critical - PHP object injection - SA-CONTRIB-2026-278 (drupal.org, CC BY-SA 2.0)
2026-11-03
Canadian Centre for Cyber Security
Canadian Centre for Cyber Security published an advisory on 2026-11-03 that names WordPress.
https://cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-1117
2026-11-03
CISA Known Exploited Vulnerabilities
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability (CISA KEV catalogue, CC0)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
2026-10-28
WordPress.org security releases
WordPress.org security releases published an advisory on 2026-10-28 that names WordPress.
2026-10-26
CISA Known Exploited Vulnerabilities
PHP Memory Corruption Vulnerability (CISA KEV catalogue, CC0)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
2026-10-26
CISA Known Exploited Vulnerabilities
PHP Stale Internal Request-State Vulnerability (CISA KEV catalogue, CC0)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
2026-10-21
WordPress.org security releases
WordPress.org security releases published an advisory on 2026-10-21 that names PHP.
https://wordpress.org/news/2026/10/critical-php-security-release/
Items from the last 30 days, at most 40, refreshed daily. A name here means the software can appear on a site; whether yours runs it, and which version, is what a review reads.
Sources
CISA Known Exploited Vulnerabilities
read today
CC0 1.0 per the LICENSE of github.com/cisagov/kev-data, read 2026-11-06
Canadian Centre for Cyber Security
read today
canada.ca/en/transparency/terms.html, read 2026-11-07: commercial redistribution needs prior written permission, so we link and write our own line, never the title
Centre canadien pour la cybersécurité
read today
same as cccs-en
CISA cybersecurity advisories
read today
no reuse clause found on cisa.gov/privacy-policy, 2026-11-07: link and our own line only
WordPress.org security releases
read today
no reuse clause found, 2026-11-07: link and our own line only
Drupal core security advisories
read today
drupal.org/terms B.2 and I.1, read 2026-11-07: content CC BY-SA 2.0; links allowed if they suggest no endorsement
Drupal contributed-module security advisories
read today
same as drupal-core
Wordfence
not used: unread: the terms page answered 202 with an empty body on 2026-11-07
unread: the terms page answered 202 with an empty body on 2026-11-07
Shopify developer changelog
not used: no working feed found on 2026-11-07
no working feed found on 2026-11-07