Measure and track the exposure window for vulnerabilities on your platform

For large-scale learning and content platforms, the website is often the one public-facing system that sits outside the controls applied to everything else. Our Vulnerability Tracker shows the vulnerabilities disclosed across the technologies your platform runs on, and how many could be exploited remotely.

Vulnerability tracker

Set the clock

Pick a date

Last pentest: DD / MM / YYYY

XX:XX:XX UTC

In the last 30 days:

Sep XX, XXXX → Oct XX, XXXX · 30 days of public disclosure

CVEs were published

- MIN

Average time between CVE disclosures

Figures are drawn from public vulnerability data and updated once a day. The Vulnerability Tracker does not scan any website and does not store anything entered.

XX:XX:XX UTC

Exposure cascade

Everything published, narrowed to what an attacker can actually reach and exploit

CVEs published

Externally exploitable

Added to CISA KEV

Externally exploitable KEVs

Over 30 days, - vulnerabilities in internet-reachable systems were discovered. Of these, - are known to be exploited by threat actors.

Filter by technology

Explore the number of exposures in the last 30 days by vendor, application or service.

- CVEs mention “” · - externally exploitable · - in CISA KEV

CVE	Severity	Flags	Date	Description
		Network KEV
No CVEs match “”.

Want to know what’s exposed on your site?

Schedule a consultation

Top exposures exploited

The most critical exploited exposures in the last 30 days

No critical exploited vulnerabilities in the last 30 days.

The importance of website security for large-scale learning and content platforms

A compromised platform can quickly damage the trust that users place in it, which can impact public confidence, service delivery and long-term relationships.

The top WordPress vulnerabilities in 2026: what the latest Wordfence data tells us

Personal data at scale

Public-facing platforms can hold and process highly confidential data which carries heightened protection under data protection laws such as UK GDPR.

Availability when it matters

Service disruption, major events and busy periods can drive sharp spikes in traffic, and the platform needs to stay secure and available when people depend on it most.

Procurement and assurance

A weakness in the website can put regulatory standing at risk where security posture is closely scrutinised by regulators and clients alike.

Public confidence

Public bodies and well-known platforms can be targets for hacktivist defacement and denial-of-service activity, where the aim is visible disruption that undermines confidence in the organisation.

What an optimal patching posture looks like for large-scale public-facing platforms

Websites need to be held to the same vulnerability management standard as any other internet-facing system. That means monitoring vulnerability feeds at least daily, patching to a fixed monthly baseline and addressing high and critical vulnerabilities as soon as they are disclosed.

Our Cyber Shield SLA delivers this standard across every site we manage, with real-time vulnerability monitoring and between-cycle patching at no additional cost, giving security teams records they can include in their wider assurance reporting.

Cyber Shield SLA

Websites typically sit outside an organisation’s operational security perimeter

Security investment across public bodies, transport and education is rightly focused on core services and operational systems, while the public website is often managed by communications teams, individual departments or external suppliers.

Websites typically run third-party code and represent the organisation publicly so an unpatched vulnerability carries reputational and regulatory consequences out of proportion to its technical scope.

SoBold’s Vulnerability Tracker brings disclosures across the technologies websites run on into view, giving IT and security teams the visibility to bring the website into the same vulnerability management programme as the rest of the estate.

What the Vulnerability Tracker can't show

Code Audit service

The Vulnerability Tracker counts disclosures across the selected technologies, while a code audit checks what is actually installed on a site against them.

Code Audits

FAQs on the Vulnerability Tracker data

Get in touch with Will for more answers.

020 3137 8596 hello@soboldltd.com

Vulnerability data is published by technology rather than by sector, so the tracker filters by default to technologies commonly found across energy and infrastructure web platforms. Clearing the filter shows every disclosure in the selected date range.

Both have standard identifiers in NVD and are included in the default filter, alongside WordPress and the wider web stack.

Message sent

Thanks for reaching out. We’ll be in touch within one working day to confirm your .