SoBold logo

Measure and track the exposure window for vulnerabilities on your website

For energy and infrastructure operators, the website is often the one public-facing system that sits outside the controls applied to everything else. Our Vulnerability Tracker shows the vulnerabilities disclosed across the technologies your website runs on, and how many could be exploited remotely.

Vulnerability tracker

Set the clock

XX:XX:XX UTC

In the last 30 days:

Sep XX, XXXX → Oct XX, XXXX · 30 days of public disclosure

-

CVEs were published

- MIN

Average time between CVE disclosures

Figures are drawn from public vulnerability data and updated once a day. The Vulnerability Tracker does not scan any website and does not store anything entered.

Exposure cascade

Everything published, narrowed to what an attacker can actually reach and exploit

-

CVEs published

-

Externally exploitable

-

Added to CISA KEV

-

Externally exploitable KEVs

Over 30 days, - vulnerabilities in internet-reachable systems were discovered. Of these, - are known to be exploited by threat actors.

Filter by technology

Explore the number of exposures in the last 30 days by vendor, application or service.

- CVEs mention “” · - externally exploitable · - in CISA KEV

CVE Severity Flags Date Description
No CVEs match “”.

Want to know what’s exposed on your site?

Schedule a consultation

Top exposures exploited

The most critical exploited exposures in the last 30 days

No critical exploited vulnerabilities in the last 30 days.

The importance of website security in the energy and infrastructure sector

A compromised website can expose stakeholder data, disrupt communications and draw regulatory attention to the wider control environment.

The top WordPress vulnerabilities in 2026: what the latest Wordfence data tells us

Regulatory scrutiny

Energy operators are assessed against frameworks such as the NIS Regulations and the NCSC Cyber Assessment Framework. While the website is rarely in scope as an essential service, a compromise still raises questions about the wider control environment.

Communications during incidents

During outages, supply disruption or major projects, the website becomes the main channel for updates to customers, communities and stakeholders, so it needs to stay available and accurate when it is under the most pressure.

Targeted threat activity

The NCSC has repeatedly warned of state-linked and hacktivist activity aimed at the energy and infrastructure sector, and public-facing websites are a common target for defacement and denial-of-service attacks.

Connected portals

Supplier, investor, grid connection and consultation portals each hold data and connect to internal systems, so every portal linked to the website adds to the risk.

What an optimal patching posture looks like for energy and infrastructure websites

Websites need to be held to the same vulnerability management standard as any other internet-facing system. That means monitoring vulnerability feeds at least daily, patching to a fixed monthly baseline and addressing high and critical vulnerabilities as soon as they are disclosed.

Our Cyber Shield SLA delivers this standard across every site we manage, with real-time vulnerability monitoring and between-cycle patching at no additional cost, giving security teams records they can include in their wider assurance reporting.

The website typically sits outside the operational security perimeter

Security investment in energy and infrastructure is rightly focused on operational technology and the systems that keep supply running, while the public website is often managed by communications teams or an external agency. 

Websites typically run third-party code, represent the organisation publicly and could host stakeholder portals, so an unpatched vulnerability there carries reputational and regulatory consequences out of proportion to its technical scope.

SoBold’s Vulnerability Tracker brings disclosures across the technologies websites run on into view, giving IT and security teams the visibility to bring the website into the same vulnerability management programme as the rest of the estate.

What the Vulnerability Tracker can't show

Code Audit service

The Vulnerability Tracker counts disclosures across the selected technologies, while a code audit checks what is actually installed on a site against them.

Code Audits

Related news

Agency

SoBold joins the Harbour Collective

Will Newland

2 min read
Security

What Wordfence’s September 2026 WordPress malware report means for enterprise sites

Sam Phillips

8 min read
Security Enterprise

The top WordPress vulnerabilities in 2026: what the latest Wordfence data tells us

Will Newland

7 min read
AI SEO Healthcare, Life Sciences & MedTech

Building LLM visibility for B2B healthtech businesses

Will Newland

5 min read

FAQs on the Vulnerability Tracker data

Will Newland - SoBold founder

Get in touch with Will for more answers.

020 3137 8596 hello@soboldltd.com

Vulnerability data is published by technology rather than by sector, so the tracker filters by default to technologies commonly found across energy and infrastructure web platforms. Clearing the filter shows every disclosure in the selected date range.

That depends on the organisation and the services it provides, and should be confirmed with the relevant competent authority or a legal adviser. In most cases the essential service is operational rather than the website, although many organisations apply the same vulnerability management standards to it as a matter of good practice.

Patching under our Cyber Shield SLA can be scheduled around change control and freeze periods, with high and critical vulnerabilities handled through an agreed emergency change route.