Vulnerabilities

What's being exploited, and is your app affected?

Every new critical and high vulnerability across npm, PyPI, Go, Rust, PHP and more, with a flag on the ones attackers are using right now. Merged from eight free public feeds, updated through the day.

Step 1

Is your app affected?

Paste this prompt into Claude Code, Cursor or any AI coding tool. It scans your project for free and fixes what it finds.

See the prompt
Check this app for security problems with Shippable. Start the dev server if it isn't running, then run `npx shippable-dev scan <dev server URL>` in the project folder. It checks the code, the dependencies (including vulnerabilities attackers are exploiting right now) and the running app. Fix every critical and high finding, most urgent first, then run the scan again to confirm they're gone. Tell me about anything you couldn't fix.

Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.

Patchy holding up an envelope and pointing at itStep 2

Get an email when it's exploited

One short email when something new is actively exploited. Free, at most one a day, one-click unsubscribe.

32 vulnerabilities were newly exploited in the last 30 days.

32Added to actively exploitedlast 30 days88New critical vulnerabilitiespublished last 7 days9Critical or high, no patch yetlast 30 days28 Oct, 06:18 UTCLast updatedfeeds as RSS

Actively exploited

On the CISA Known Exploited list. Newest first.

See all actively exploited →

No patch yet: mitigate now

Upgrading won't help. Remove the package, switch it off or follow the advisory's workaround.

See all with no patch →

Featured incidents

Feeds and AI brief

A prompt for Claude Code, Cursor or Codex covering the 13 latest.
RSSJSON

Filter with ?exploited=1&ecosystem=npm&patch=none. Ecosystems: npm, pip, composer, go, rubygems, rust, maven, nuget, pub, swift, erlang, actions.

Latest vulnerabilities

Copies a prompt for Claude Code, Cursor or Codex covering 13 of the latest; 7 left out.