SoBold logo

Measure and track your website exposure window

 

SoBold's Vulnerability Tracker counts the vulnerabilities disclosed across selected technologies and details how many could be exploited remotely.

Vulnerability tracker

Set the clock

XX:XX:XX UTC

In the last 30 days:

Sep XX, XXXX → Oct XX, XXXX · 30 days of public disclosure

-

CVEs were published

- MIN

Average time between CVE disclosures

Figures are drawn from public vulnerability data and updated once a day. The Vulnerability Tracker does not scan any website and does not store anything entered.

Exposure cascade

Everything published, narrowed to what an attacker can actually reach and exploit

-

CVEs published

-

Externally exploitable

-

Added to CISA KEV

-

Externally exploitable KEVs

Over 30 days, - vulnerabilities in internet-reachable systems were discovered. Of these, - are known to be exploited by threat actors.

Filter by technology

Explore the number of exposures in the last 30 days by vendor, application or service.

- CVEs mention “” · - externally exploitable · - in CISA KEV

CVE Severity Flags Date Description
No CVEs match “”.

Want to know what’s exposed on your site?

Schedule a consultation

Top exposures exploited

The most critical exploited exposures in the last 30 days

No critical exploited vulnerabilities in the last 30 days.

What the vulnerability data means

The Vulnerability Tracker combines data from the US National Vulnerability Database and the CISA Known Exploited Vulnerabilities catalogue to produce four figures.

The top WordPress vulnerabilities in 2026: what the latest Wordfence data tells us

Vulnerabilities disclosed

The number of CVEs published within the selected date range for the chosen technologies.

A CVE (Common Vulnerabilities and Exposures) record is the public entry for a disclosed security flaw, identified by a unique reference in the format CVE-year-number.

 

 

 

Remotely exploitable

The number of those CVEs whose CVSS attack vector is rated “network”, meaning exploitation could be attempted over the internet.

CVSS (Common Vulnerability Scoring System) is the industry standard for rating vulnerability severity on a scale of 0 to 10.

 

 

 

Known to be exploited

The number of vulnerabilities added to the CISA Known Exploited Vulnerabilities catalogue within the selected date range, each with confirmed real-world exploitation.

CISA is the US Cybersecurity and Infrastructure Security Agency, the government body that maintains the catalogue

 

 

 

A new disclosure every

The selected date range divided by the number of CVEs disclosed, giving the average interval between new vulnerabilities being published.

 

 

 

What an optimal patching posture for your website should look like

The exposure window is the time between a vulnerability being disclosed and it being patched on a site, and the most secure websites keep that window as short as possible.

That means monitoring against vulnerability feeds at least daily, patching to a fixed monthly baseline, and addressing high and critical vulnerabilities as soon as they are disclosed rather than waiting for the next cycle.

This is the posture our Cyber Shield SLA is built around, with real-time vulnerability monitoring across every site we manage and between-cycle patching at no additional cost.

 

The website is often the gap in an otherwise governed tech stack  

Schedule a consultation

Most businesses run formal security controls across their technology stacks, from endpoint detection and network monitoring to identity and access management, often aligned to frameworks such as ISO 27001 or Cyber Essentials.

The public website frequently sits outside that governance, owned by marketing or managed externally, despite running third-party code, processing user data and having heavy integrations.

It is often covered through an annual penetration test, which gives an accurate picture of the site on the day it is tested but not of the vulnerabilities disclosed in the months that follow.

As a result, vulnerabilities disclosed against website software often fall outside the organisation’s vulnerability management programme
between tests.

SoBold’s Vulnerability Tracker brings those disclosures into view, giving IT and security teams continuous visibility of the risk across the web stack.

 

What the Vulnerability Tracker can't show

Code Audit service

The Vulnerability Tracker counts disclosures across the selected technologies, while a code audit checks what is actually installed on a site against them.

Code Audits

Related news

Security

What Wordfence’s September 2026 WordPress malware report means for enterprise sites

Sam Phillips

8 min read
Security Enterprise

The top WordPress vulnerabilities in 2026: what the latest Wordfence data tells us

Will Newland

7 min read
Development Security Agency

Taking a security-first approach to prevent attacks across client websites

Will Newland

4 min read
AI Development Security +2

Website security and why you need to act now

Will Newland

8 min read

Vulnerability Tracker FAQs

Will Newland - SoBold founder

Get in touch with Will for more answers.

020 3137 8596 hello@soboldltd.com

Disclosure counts and severity scores come from the National Vulnerability Database (NVD), run by the US National Institute of Standards and Technology. 

Exploitation data comes from the CISA Known Exploited Vulnerabilities catalogue. 

Both are public sources used across the security industry.

 

The Vulnerability Tracker syncs with its sources once a day.

 

NVD has had a backlog in scoring and tagging new CVEs since 2024, so some recent vulnerabilities appear without severity data or technology tags for a few weeks. As a result, counts for the last 30 days can understate the real picture.

 

Not necessarily, as it means exploitation over a network is possible in principle.

Whether it is possible on a specific site depends on the software installed and how it is configured.

CISA adds a vulnerability to the catalogue when it has evidence of real-world exploitation, which can be months or years after disclosure. 

The Vulnerability Tracker counts additions by the date they entered the catalogue.

 

Anything with a standard identifier in NVD, which covers most commercial and open-source software. 

For WordPress sites, the most useful filters are WordPress core, PHP, the database (MySQL or MariaDB) and the web server (nginx or Apache).

 

No, it uses public data only and never connects to any website, domain or infrastructure.

 

No, the date range and filters selected are not stored on our servers or in the browser.

 

Work with our team to build and scale your bespoke requirements.

Once you submit the form one of our team will contact you to set up a meeting to clarify your requirements and build a quote.

Working with leading b2b clients

    Message sent

    Thanks for reaching out. We'll be in touch within one working day to confirm your call.