Software on your website or server has a known vulnerability

A CVE is a numbered public flaw in a named version of software. The alert tells you which product, which versions, how bad, whether attackers are already using it, and the version that fixes it. Your job is to get it updated.

Is this urgent?

Critical or exploited: today. High: this week. Medium and low: next maintenance.

Easy fix, no technical skills

Check the alert's affected versions against what you run (our scan shows it). If your version is not in range, mark the alert Not relevant.
Send the alert to whoever maintains the site or server with Send to my IT person.
If there is no fix yet, ask them to apply the vendor's workaround or put the software behind a firewall.

Hand it to your IT person

Copy this into an email or chat. Replace the brackets with the details from your alert.

(Product) (version) on example.com is affected by (CVE), CVSS (score), (exploited or not). Fixed in (version). Please update or apply the vendor workaround: (advisory link).

Technical fix (commands)

Ubuntu packages.

sudo apt update && sudo apt list --upgradable
sudo apt upgrade

Node, PHP, nginx versions.
```
node -v
php -v
nginx -v
```

Check it worked

The version is at or above the fixed version; our software page for it shows the CVE as fixed.

Scan the site's software, or check its security headers with the free tool. All free tools.

Prevent it next time

Automatic security updates.
Declare the software you run so we can match advisories to it.

Common questions

Is this urgent?

Critical or exploited: today. High: this week. Medium and low: next maintenance.

Can I fix this without technical skills?

Yes. The easy fix below needs no technical skills; the commands are only for your IT person.

How long does it take?

About 20 minutes once you know who runs the website.

Hear about this before your customers do

Add your website and we check uptime, certificates, domains and email security for you, free.

Add my website Scan it first