Free check

Does it affect you? Check it now, for free.

Pick your runtime and version, drop in your config files or enter your website address. The check takes seconds, you see the result as soon as you join the waitlist: whether current critical vulnerabilities hit you, with evidence and a fix. Even when they sit in the runtime and not in your packages.

Enter your website (current)
Check (upcoming)
Waitlist (upcoming)
Result (upcoming)

Checked against the most critical vulnerabilities of recent weeks (as of: 25 Oct 2026).

Currently checked

Checked against the most critical vulnerabilities of recent weeks (as of: 25 Oct 2026).

PHP2ShellCVE-2026-109618 / CVE-2026-109619 · CVSS 9.2
PHP, affected: 8.2 < 8.2.35, 8.3 < 8.3.36, 8.4 < 8.4.27, 8.5 < 8.5.12
8.2.35 / 8.3.36 / 8.4.27 / 8.5.12
HTTP2Shell / Node2ShellCVE-2026-111497 · CVSS 9.2
Node.js, affected: 22 < 22.23.4, 24 < 24.22.1, 26 < 26.12.1
22.23.4 / 24.22.1 / 26.12.1
Versions without support count as affected according to the advisory.
HTTP2Shell / Node2ShellCVE-2026-111497 · CVSS 9.2
libbrotli (System), affected: 1.0.3 < 1.0.10, 1.1 < 1.1.1, 1.2 < 1.2.1
1.0.10 / 1.1.1 / 1.2.1
HTTP2Shell / Node2ShellCVE-2026-111497 · CVSS 9.2
Bun, affected: 0 < 1.4.4
1.4.4
HTTP2Shell / Node2ShellCVE-2026-111497 · CVSS 9.2
Python: brotli, affected: 1.0.3 < 1.2.1
1.2.1
HTTP2Shell / Node2ShellCVE-2026-111497 · CVSS 9.2
Python: brotlicffi, affected: 0 < 1.2.1
1.2.1.0
HTTP2Shell / Node2ShellCVE-2026-111497 · CVSS 9.2
Envoy, affected: 1.36 < 1.36.12, 1.37 < 1.37.8, 1.38 < 1.38.6, 1.39 < 1.39.3
1.36.12 / 1.37.8 / 1.38.6 / 1.39.3
GitLab CI/CD-RCECVE-2026-97229 · CVSS 10
GitLab, affected: 19.2 < 19.2.8, 19.3 < 19.3.5, 19.4 < 19.4.2
19.2.8 / 19.3.5 / 19.4.2
GitLab Regex RCECVE-2026-110264 · CVSS 10
GitLab, affected: 7 < 18.11.13, 19 < 19.0.10, 19.1 < 19.1.9, 19.2 < 19.2.9, 19.3 < 19.3.6, 19.4 < 19.4.3, 19.5 < 19.5.1
18.11.13 / 19.0.10 / 19.1.9 / 19.2.9 / 19.3.6 / 19.4.3 / 19.5.1

All critical vulnerabilities of the last 14 days →

This is not a full CVE scan, just a quick look at the vulnerabilities that burn the most right now.

Quick check and file check run entirely in your browser. Nothing leaves your device. You can verify this in the Network tab of your developer tools.

For the website check, the address goes to the Stackwatch API. It fetches the home page once and reads the response headers and at most the first 64 KB of the page to recognize the platform (e.g. WordPress). None of it is stored.