What the scanner has found so far
Updated 10 November 2026, scanning since 7 November 2026.
~100,100
websites checked
1 in 19
runs software with known security holes
56%
of those include a hole attackers are already using
Totals
| Websites checked | 100,100 | |
| Running software with known vulnerabilities | 5,373 | 5% of checked |
| …with a CVE in CISA's KEV catalog | 3,011 | 56% |
| …where that KEV CVE applies as is | 1,823 | 34% |
| …on an end-of-life PHP branch | 2,413 | 45% |
| …with a published contact address | 2,727 | 51% |
| Notices sent | 14 | |
| Discarded as false readings | 92 |
Most often affected
Flagged websites where the component carries at least one matched CVE. A site can count more than once.
- PHP · Language runtime2,234
- WordPress core · CMS1,237
- Apache HTTP Server · Web server1,000
- nginx · Web server703
- Contact Form 7 · WordPress plugin245
- Drupal core · CMS45
- WooCommerce · WordPress plugin30
- Microsoft IIS · Web server14
How to read these
A flag is a version match, not a confirmed vulnerability, and version matching has limits. “Applies as is” means the KEV CVE doesn't depend on a module, setting or distribution build the scan can't see.
Notices sent only counts emails actually delivered. Sites without a published contact address are never emailed, so that number stays below the number of flagged sites.
The same numbers as JSON: /stats.json