Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,602 results · page 5 of 53
Oct 9, 2025Memory corruption while processing control commands in the virtual memory management interface.CVE-2025-47347 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing control commands in the virtual memory management interface.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Transient DOS may occur when multi-profile concurrency arises with QHS enabled.CVE-2025-47342 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.1
Transient DOS may occur when multi-profile concurrency arises with QHS enabled.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025memory corruption while processing an image encoding completion event.CVE-2025-47341 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
memory corruption while processing an image encoding completion event.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Memory corruption while processing IOCTL call to get the mapping.CVE-2025-47340 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing IOCTL call to get the mapping.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Memory corruption while processing escape commands from userspace.CVE-2025-47338 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing escape commands from userspace.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Memory corruption while performing SCM call with malformed inputs.CVE-2025-27060 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.8
Memory corruption while performing SCM call with malformed inputs.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Memory corruption while performing SCM call.CVE-2025-27059 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.8
Memory corruption while performing SCM call.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Memory corruption while processing a malformed license file during reboot.CVE-2025-27054 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing a malformed license file during reboot.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Memory corruption during PlayReady APP usecase while processing TA commands.CVE-2025-27053 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption during PlayReady APP usecase while processing TA commands.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Transient DOS while processing IOCTL call for image encoding.CVE-2025-27049 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.5
Transient DOS while processing IOCTL call for image encoding.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Memory corruption while processing camera platform driver IOCTL calls.CVE-2025-27048 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing camera platform driver IOCTL calls.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Information disclosure while processing batch command execution in Video driver.CVE-2025-27045 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
Information disclosure while processing batch command execution in Video driver.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Transient DOS while processing video packets received from video firmware.CVE-2025-27041 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.5
Transient DOS while processing video packets received from video firmware.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Information disclosure may occur while processing the hypervisor log.CVE-2025-27040 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Information disclosure may occur while processing the hypervisor log.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.CVE-2025-27039 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.6
Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025redragon-erp v1.0 was discovered to contain a Shiro deserialization vulnerability caused by the default Shiro key.CVE-2025-60830 · Other software · Redragon-erp · reported by MITREMedium 6.5
redragon-erp v1.0 was discovered to contain a Shiro deserialization vulnerability caused by the default Shiro key.
- Product
- Redragon-erp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Sep 25, 2025Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or Element vulnerabilitCVE-2025-43993 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code Execution.
- Product
- Wireless 5932e
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption while handling invalid inputs in application info setup.CVE-2025-47329 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while handling invalid inputs in application info setup.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Transient DOS while processing power control requests with invalid antenna or stream values.CVE-2025-47328 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS while processing power control requests with invalid antenna or stream values.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption while encoding the image data.CVE-2025-47327 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while encoding the image data.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Transient DOS while handling command data during power control processing.CVE-2025-47326 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS while handling command data during power control processing.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Transient DOS while parsing the EPTM test control message to get the test pattern.CVE-2025-47318 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS while parsing the EPTM test control message to get the test pattern.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption due to global buffer overflow when a test command uses an invalid payload type.CVE-2025-47317 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption due to global buffer overflow when a test command uses an invalid payload type.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption due to double free when multiple threads race to set the timestamp store.CVE-2025-47316 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption due to double free when multiple threads race to set the timestamp store.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption while handling repeated memory unmap requests from guest VM.CVE-2025-47315 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while handling repeated memory unmap requests from guest VM.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption while processing data sent by FE driver.CVE-2025-47314 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing data sent by FE driver.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption while processing message in guest VM.CVE-2025-27077 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing message in guest VM.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.CVE-2025-27037 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Information disclosure when Video engine escape input data is less than expected minimum size.CVE-2025-27036 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
Information disclosure when Video engine escape input data is less than expected minimum size.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption while selecting the PLMN from SOR failed list.CVE-2025-27034 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption while selecting the PLMN from SOR failed list.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Information disclosure while running video usecase having rogue firmware.CVE-2025-27033 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
Information disclosure while running video usecase having rogue firmware.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.CVE-2025-27032 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025information disclosure while invoking calibration data from user space to update firmware size.CVE-2025-27030 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
information disclosure while invoking calibration data from user space to update firmware size.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.CVE-2025-21488 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.2
Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.CVE-2025-21487 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.2
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.CVE-2025-21484 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.2
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.CVE-2025-21483 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Cryptographic issue while performing RSA PKCS padding decoding.CVE-2025-21482 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.1
Cryptographic issue while performing RSA PKCS padding decoding.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption while performing private key encryption in trusted application.CVE-2025-21481 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while performing private key encryption in trusted application.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.CVE-2025-21476 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2025-59410 · Other software · dragonflyoss · reported by GitHubMedium 5.5
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing the network request so that a different piece of data gets downloaded. This vulnerability is fixed in 2.1.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2025-59354 · Other software · dragonflyoss · reported by GitHubMedium 5.5
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files. This allows attackers to replace files with malicious ones that have a colliding hash. This vulnerability is fixed in 2.1.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2025-59353 · Other software · dragonflyoss · reported by GitHubHigh 7.7
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request. This vulnerability is fixed in 2.1.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2025-59352 · Other software · dragonflyoss · reported by GitHubMedium 6.9
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal other peers’ secret data and to gain remote code execution (RCE) capabilities on the peer’s machine.This vulnerability is fixed in 2.1.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2025-59351 · Other software · dragonflyoss · reported by GitHubLow 2.7
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the first return value of a function is dereferenced even when the function returns an error. This can result in a nil dereference, and cause code to panic. This vulnerability is fixed in 2.1.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2025-59350 · Other software · dragonflyoss · reported by GitHubLow 2.7
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’s execution times. This vulnerability is fixed in 2.1.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2025-59349 · Other software · dragonflyoss · reported by GitHubLow 2
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certain directory paths with specific access permissions. This function does not perform any permission checks when a given directory path already exists. This allows a local attacker to create a directory to be used later by DragonFly2 with broad permissions before DragonFly2 does so, potentially allowing the attacker to tamper with the files. This vulnerability is fixed in 2.1.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2025-59348 · Other software · dragonflyoss · reported by GitHubMedium 5.5
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure’s usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the result.Size variable. A task is processed by a peer. The usedTraffic metadata is not updated during the processing. Rate limiting is incorrectly applied, leading to a denial-of-service condition for the peer. This vulnerability is fixed in 2.1.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2025-59347 · Other software · dragonflyoss · reported by GitHubLow 2.7
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTTP clients. The clients are not configurable, so users have no way to re-enable the verification. A Manager processes dozens of preheat jobs. An adversary performs a network-level Man-in-the-Middle attack, providing invalid data to the Manager. The Manager preheats with the wrong data, which later causes a denial of service and file integrity problems. This vulnerability is fixed in 2.1.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2025-59346 · Other software · dragonflyoss · reported by GitHubMedium 5.5
Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery (SSRF) vulnerability that enables users to force DragonFly2’s components to make requests to internal services that are otherwise not accessible to them. The issue arises because the Manager API accepts a user-supplied URL when creating a Preheat job with weak validation, peers can trigger other peers to fetch an arbitrary URL through pieceManager.DownloadSource, and internal HTTP clients follow redirects, allowing a request to a malicious server to be redirected to internal services. This can be used to probe or access internal HTTP endpoints. The vulnerability is fixed in version 2.1.0.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.