Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,281 results · page 5 of 26
Oct 11, 2025Denial of service (DoS) vulnerability in the office service.CVE-2025-58291 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Denial of service (DoS) vulnerability in the office service.CVE-2025-58290 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Denial of service (DoS) vulnerability in the office service.CVE-2025-58288 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Use After Free (UAF) vulnerability in the office service.CVE-2025-58287 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Denial of service (DoS) vulnerability in the office service.CVE-2025-58286 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Permission control vulnerability in the media module.CVE-2025-58285 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Permission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Permission control vulnerability in the network module.CVE-2025-58284 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Permission control vulnerability in the Wi-Fi module.CVE-2025-58283 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Permission control vulnerability in the camera module.CVE-2025-58282 · Other software · Huawei · reported by psirt@huawei.comLow 2.8
Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Identity authentication bypass vulnerability in the Gallery app.CVE-2025-58278 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2025Permission verification bypass vulnerability in the Camera app.CVE-2025-58277 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025Permission control vulnerability in the Gallery module.CVE-2025-54654 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentiality
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Race condition vulnerability in the device standby module.CVE-2025-58313 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Race condition vulnerability in the device standby module. Impact: Successful exploitation of this vulnerability may cause feature exceptions of the device standby module.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Race condition vulnerability in the audio module.CVE-2025-58296 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect function stability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Out-of-bounds read vulnerability in the runtime interpreter module.CVE-2025-58281 · Other software · Huawei · reported by psirt@huawei.comHigh 8.4
Out-of-bounds read vulnerability in the runtime interpreter module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Vulnerability of exposing object heap addresses in the Ark eTS module.CVE-2025-58280 · Other software · Huawei · reported by psirt@huawei.comHigh 8.4
Vulnerability of exposing object heap addresses in the Ark eTS module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Permission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-58276 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Permission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties.CVE-2025-3831 · Other software · checkpoint · reported by cve@checkpoint.comHigh 8.1
Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties.
- Product
- Check Point Harmony SASE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.checkpoint.com
Aug 11, 2025in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.CVE-2025-27577 · Other software · OpenHarmony · reported by scy@openharmony.ioHigh 8.4
in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2025-27562 · Other software · OpenHarmony · reported by scy@openharmony.ioLow 3.3
in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through type confusion.CVE-2025-27536 · Other software · OpenHarmony · reported by scy@openharmony.ioLow 3.3
in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through type confusion.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.CVE-2025-27128 · Other software · OpenHarmony · reported by scy@openharmony.ioHigh 8.4
in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.CVE-2025-26690 · Other software · OpenHarmony · reported by scy@openharmony.ioLow 3.3
in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.CVE-2025-25278 · Other software · OpenHarmony · reported by scy@openharmony.ioHigh 8.4
in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through improper input.CVE-2025-25212 · Other software · OpenHarmony · reported by scy@openharmony.ioLow 3.3
in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through improper input.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2025-24925 · Other software · OpenHarmony · reported by scy@openharmony.ioLow 3.3
in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.CVE-2025-24844 · Other software · OpenHarmony · reported by scy@openharmony.ioLow 3.3
in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.CVE-2025-24298 · Other software · OpenHarmony · reported by scy@openharmony.ioHigh 8.4
in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Race condition vulnerability in the kernel hufs module.CVE-2025-54651 · Other software · Huawei · reported by psirt@huawei.comMedium 4.8
Race condition vulnerability in the kernel hufs module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Improper array index verification vulnerability in the audio codec module.CVE-2025-54650 · Other software · Huawei · reported by psirt@huawei.comMedium 4.2
Improper array index verification vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect the audio decoding function.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Vulnerability of using incompatible types to access resources in the location service.CVE-2025-54649 · Other software · Huawei · reported by psirt@huawei.comMedium 4.5
Vulnerability of using incompatible types to access resources in the location service. Impact: Successful exploitation of this vulnerability may cause some location information attributes to be incorrect.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack.CVE-2025-54648 · Other software · Huawei · reported by psirt@huawei.comMedium 5.4
Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack.CVE-2025-54647 · Other software · Huawei · reported by psirt@huawei.comMedium 5.4
Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Vulnerability of inadequate packet length check in the BLE module.CVE-2025-54646 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Vulnerability of inadequate packet length check in the BLE module. Impact: Successful exploitation of this vulnerability may affect performance.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Out-of-bounds array access issue due to insufficient data verification in the location service module.CVE-2025-54645 · Other software · Huawei · reported by psirt@huawei.comMedium 5
Out-of-bounds array access issue due to insufficient data verification in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module.CVE-2025-54644 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module.CVE-2025-54643 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Issue of buffer overflow caused by insufficient data verification in the kernel gyroscope module.CVE-2025-54642 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Issue of buffer overflow caused by insufficient data verification in the kernel gyroscope module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025Issue of buffer overflow caused by insufficient data verification in the kernel acceleration module.CVE-2025-54641 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Issue of buffer overflow caused by insufficient data verification in the kernel acceleration module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025ParcelMismatch vulnerability in attribute deserialization.CVE-2025-54640 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control screen display exceptions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025ParcelMismatch vulnerability in attribute deserialization.CVE-2025-54639 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control screen display exceptions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Issue of inconsistent read/write serialization in the ad module.CVE-2025-54638 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Issue of inconsistent read/write serialization in the ad module. Impact: Successful exploitation of this vulnerability may affect the availability of the ad service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module.CVE-2025-54637 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Issue of buffer overflow caused by insufficient data verification in the kernel drop detection module.CVE-2025-54636 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Issue of buffer overflow caused by insufficient data verification in the kernel drop detection module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Vulnerability of returning released pointers in the distributed notification service.CVE-2025-54635 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Vulnerability of returning released pointers in the distributed notification service. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Vulnerability of improper processing of abnormal conditions in huge page separation.CVE-2025-54634 · Other software · Huawei · reported by psirt@huawei.comHigh 8
Vulnerability of improper processing of abnormal conditions in huge page separation. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Out-of-bounds read vulnerability in the register configuration of the DMA module.CVE-2025-54633 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Out-of-bounds read vulnerability in the register configuration of the DMA module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Vulnerability of insufficient data length verification in the HVB module.CVE-2025-54632 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Vulnerability of insufficient data length verification in the HVB module. Impact: Successful exploitation of this vulnerability may affect service integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025Vulnerability of insufficient data length verification in the partition module.CVE-2025-54631 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Vulnerability of insufficient data length verification in the partition module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025:Vulnerability of insufficient data length verification in the DFA module.CVE-2025-54630 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
:Vulnerability of insufficient data length verification in the DFA module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.