Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

1,068 results · page 2 of 22

May 15, 2026Permission control vulnerability in the manufacturability design module.CVE-2026-41967 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
May 15, 2026Permission control vulnerability in the smart sensing service.CVE-2026-41966 · Other software · Huawei · reported by psirt@huawei.comMedium 5.6
Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
May 15, 2026Use-After-Free (UAF) vulnerability in the web.CVE-2026-41965 · Other software · Huawei · reported by psirt@huawei.comMedium 5.6
Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 15, 2026Permission control vulnerability in the web.CVE-2026-41964 · Other software · Huawei · reported by psirt@huawei.comHigh 8.4
Permission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 15, 2026Stack overflow vulnerability in the media platform.CVE-2026-41963 · Other software · Huawei · reported by psirt@huawei.comLow 2.8
Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 15, 2026Permission control vulnerability in the app management and control module.CVE-2026-41962 · Other software · Huawei · reported by psirt@huawei.comLow 3.6
Permission control vulnerability in the app management and control module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
May 15, 2026Permission control vulnerability in contacts.CVE-2026-41961 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Permission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
May 15, 2026Permission control vulnerability in calls.CVE-2026-41960 · Other software · Huawei · reported by psirt@huawei.comMedium 5.8
Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Apr 13, 2026Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.CVE-2026-34866 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Apr 13, 2026Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.CVE-2026-34865 · Other software · Huawei · reported by psirt@huawei.comCritical 10
Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Apr 13, 2026Boundary-unlimited vulnerability in the application read module.CVE-2026-34864 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Boundary-unlimited vulnerability in the application read module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026Out-of-bounds write vulnerability in the file system.CVE-2026-34863 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Out-of-bounds write vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Apr 13, 2026Race condition vulnerability in the power consumption statistics module.CVE-2026-34862 · Other software · Huawei · reported by psirt@huawei.comMedium 6.3
Race condition vulnerability in the power consumption statistics module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026Race condition vulnerability in the thermal management module.CVE-2026-34861 · Other software · Huawei · reported by psirt@huawei.comMedium 6.3
Race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026UAF vulnerability in the kernel module.CVE-2026-34859 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026UAF vulnerability in the communication module.CVE-2026-34858 · Other software · Huawei · reported by psirt@huawei.comMedium 4.1
UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026UAF vulnerability in the communication module.CVE-2026-34857 · Other software · Huawei · reported by psirt@huawei.comMedium 4.7
UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026Out-of-bounds write vulnerability in the kernel module.CVE-2026-34855 · Other software · Huawei · reported by psirt@huawei.comMedium 5.7
Out-of-bounds write vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Apr 13, 2026UAF vulnerability in the kernel module.CVE-2026-34854 · Other software · Huawei · reported by psirt@huawei.comMedium 5.7
UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Apr 13, 2026UAF vulnerability in the screen management module.CVE-2026-34849 · Other software · Huawei · reported by psirt@huawei.comLow 2.5
UAF vulnerability in the screen management module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Apr 13, 2026Double free vulnerability in the multi-mode input system.CVE-2026-34867 · Other software · Huawei · reported by psirt@huawei.comMedium 5.6
Double free vulnerability in the multi-mode input system. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026Access control vulnerability in the memo module.CVE-2026-34860 · Other software · Huawei · reported by psirt@huawei.comMedium 4.1
Access control vulnerability in the memo module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026UAF vulnerability in the communication module.CVE-2026-34856 · Other software · Huawei · reported by psirt@huawei.comHigh 7.3
UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026Permission bypass vulnerability in the LBS module.CVE-2026-34853 · Other software · Huawei · reported by psirt@huawei.comHigh 7.7
Permission bypass vulnerability in the LBS module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026Stack overflow vulnerability in the media platform.CVE-2026-34852 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026Race condition vulnerability in the event notification module.CVE-2026-34851 · Other software · Huawei · reported by psirt@huawei.comLow 2.2
Race condition vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026Race condition vulnerability in the notification service.CVE-2026-34850 · Other software · Huawei · reported by psirt@huawei.comLow 1.9
Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Apr 13, 2026Vulnerability of improper permission control in the theme setting module.CVE-2026-28553 · Other software · Huawei · reported by psirt@huawei.comMedium 6.9
Vulnerability of improper permission control in the theme setting module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Mar 5, 2026Race condition vulnerability in the device security management module.CVE-2026-28551 · Other software · Huawei · reported by psirt@huawei.comMedium 4.7
Race condition vulnerability in the device security management module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Race condition vulnerability in the permission management service.CVE-2026-28549 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
Race condition vulnerability in the permission management service. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Vulnerability of improper verification in the email application.CVE-2026-28548 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Vulnerability of improper verification in the email application. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Mar 5, 2026Vulnerability of uninitialized pointer access in the scanning module.CVE-2026-28547 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Vulnerability of uninitialized pointer access in the scanning module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Buffer overflow vulnerability in the scanning module.CVE-2026-28546 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Buffer overflow vulnerability in the scanning module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Permission bypass vulnerability in the system service framework.CVE-2026-28542 · Other software · Huawei · reported by psirt@huawei.comHigh 7.3
Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Out-of-bounds write vulnerability in the IMS module.CVE-2026-28552 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Out-of-bounds write vulnerability in the IMS module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Race condition vulnerability in the security control module.CVE-2026-28550 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Race condition vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Race condition vulnerability in the printing module.CVE-2026-28545 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Race condition vulnerability in the printing module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Race condition vulnerability in the printing module.CVE-2026-28544 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Race condition vulnerability in the printing module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Race condition vulnerability in the maintenance and diagnostics module.CVE-2026-28543 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Race condition vulnerability in the maintenance and diagnostics module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Permission control vulnerability in the cellular_data module.CVE-2026-28541 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Permission control vulnerability in the cellular_data module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Out-of-bounds character read vulnerability in Bluetooth.CVE-2026-28540 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Out-of-bounds character read vulnerability in Bluetooth. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Data processing vulnerability in the certificate management module.CVE-2026-28539 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Data processing vulnerability in the certificate management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Path traversal vulnerability in the certificate management module.CVE-2026-28538 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Path traversal vulnerability in the certificate management module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Double free vulnerability in the window module.CVE-2026-28537 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Double free vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Permission control vulnerability in the resource scheduling module.CVE-2025-66319 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
Permission control vulnerability in the resource scheduling module. Impact: Successful exploitation of this vulnerability may affect service integrity.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Mar 5, 2026Authentication bypass vulnerability in the device authentication module.CVE-2026-28536 · Other software · Huawei · reported by psirt@huawei.comCritical 9.6
Authentication bypass vulnerability in the device authentication module. Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Feb 7, 2026A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0.CVE-2026-2131 · Other software · XixianLiang · reported by VulDBLow 2.1
A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function input_text. The manipulation of the argument text leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Product
HarmonyOS-mcp-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Feb 6, 2026Out-of-bounds write vulnerability in the file system module.CVE-2026-24928 · Other software · Huawei · reported by psirt@huawei.comMedium 5.8
Out-of-bounds write vulnerability in the file system module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Feb 6, 2026Out-of-bounds access vulnerability in the frequency modulation module.CVE-2026-24927 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Out-of-bounds access vulnerability in the frequency modulation module. Impact: Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com
Feb 6, 2026Vulnerability of improper permission control in the print module.CVE-2026-24924 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.