Products and vendors
Every vulnerability belongs to a product, and every product is published by a vendor. We read all of them the same way: which versions are affected, which version is the fix, with a link to the original advisory.
| Product | Vendor | Advisories | Newest release |
|---|---|---|---|
| Next.js | Vercel | 65 | 16.4.6 |
| WordPress | WordPress.org | 352 | 7.1.4 |
| Node.js | OpenJS Foundation | 204 | 26.13.1 |
| PHP | The PHP Group | 737 | 8.5.12 |
| Bun | Oven | 3 | 1.4.4 |
All five products were checked on or after 2026-11-14. A count is every published advisory we hold for that product. No single version has them all: open a product to see each version.
Next up
These products publish advisories, but not yet enough for us to name the affected versions on a real machine. We add one only when we can do what the five above do.
- nginx
- Apache HTTP Server
- PostgreSQL
- MySQL / MariaDB
- Ruby on Rails
- Gitea
- ClickHouse
- Traefik
No vendor pays, supplies private data, or reviews the copy. Product names are trademarks of their owners.