Industries
About
Schedule a consultation
Services
Industries
About
For law firms, the website is often the one public-facing system that sits outside the controls applied to the rest of the firm.
Pick a date
XX:XX:XX UTC
In the last 30 days:
Sep XX, XXXX → Oct XX, XXXX · 30 days of public disclosure
-
CVEs were published
- MIN
Average time between CVE disclosures
Figures are drawn from public vulnerability data and updated once a day. The Vulnerability Tracker does not scan any website and does not store anything entered.
XX:XX:XX UTC
Everything published, narrowed to what an attacker can actually reach and exploit
-
CVEs published
-
Externally exploitable
-
Added to CISA KEV
-
Externally exploitable KEVs
Over 30 days, - vulnerabilities in internet-reachable systems were discovered. Of these, - are known to be exploited by threat actors.
Explore the number of exposures in the last 30 days by vendor, application or service.
- CVEs mention “” · - externally exploitable · - in CISA KEV
Want to know what’s exposed on your site?
Schedule a consultationThe most critical exploited exposures in the last 30 days
,
No critical exploited vulnerabilities in the last 30 days.
A compromised website can put professional duties at risk and undermine the trust clients place in the firm.
The top WordPress vulnerabilities in 2026: what the latest Wordfence data tells us
Client portals, matter intake forms and secure document exchange can hold confidential and often legally privileged information, where a single exposure can breach the firm’s duties to its clients.
Law firms are regulated by bodies such as the SRA, which require them to protect client confidentiality and report serious breaches, alongside their obligations under data protection laws such as UK GDPR.
Law firms win work on reputation, and a compromised or defaced website is visible to clients, prospects and the wider market in a way most security incidents are not.
Careers sites and application portals can collect CVs, personal details and right-to-work information from large numbers of candidates, which carries its own data protection obligations.
Websites need to be held to the same vulnerability management standard as any other digital system. That means monitoring vulnerability feeds at least daily, patching to a fixed monthly baseline and addressing high and critical vulnerabilities as soon as they are disclosed.
Security investment in law firms is rightly focused on practice management, document management and the systems that hold client matters, while the public website is often managed by marketing or business development teams or an external agency.
Websites typically run third-party code and represent the firm publicly so an unpatched vulnerability carries reputational and regulatory consequences out of proportion to its technical scope.
SoBold’s Vulnerability Tracker brings disclosures across the technologies websites run on into view, giving IT and security teams the visibility to bring the website into the same vulnerability management programme as the rest of the firm.
Will Newland
2 min read
Sam Phillips
8 min read
Will Newland
7 min read
Will Newland
5 min read
Get in touch with Will for more answers.
Vulnerability data is published by technology rather than by sector, so the tracker filters by default to technologies commonly found across energy and infrastructure web platforms. Clearing the filter shows every disclosure in the selected date range.
The tracker shows public disclosure data rather than the patch status of a specific site, so it doesn’t replace evidence of patching or testing.
Clients on our Cyber Shield SLA receive patching records that can support questionnaire responses and panel reviews.
