Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

7,488 results · page 59 of 150

Aug 10, 2023Improper input validation in firmware for some Intel(R) PCSD BIOS before version 02.01.0013 may allow a privileged user to potentially enable information discloCVE-2022-34657 · Other software · Intel · reported by secure@intel.comMedium 6
Improper input validation in firmware for some Intel(R) PCSD BIOS before version 02.01.0013 may allow a privileged user to potentially enable information disclosure via local access.
Product
Pcsd Bios
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com intel.com
Aug 10, 2023Improper buffer restrictions in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via locaCVE-2022-27879 · Other software · Intel · reported by secure@intel.comMedium 5.3
Improper buffer restrictions in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Product
Pentium J6426 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record intel.com security.netapp.com
Aug 10, 2023When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.CVE-2023-37513 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
Product
HCL Traveler To Do
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 10, 2023When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.CVE-2023-37512 · Other software · HCL Software · reported by psirt@hcl.comLow 3.3
When the app is put to the background and the user goes to the task switcher of iOS, the app snapshot is not blurred which may reveal sensitive information.
Product
HCL Traveler Companion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hcltechsw.com support.hcltechsw.com
Aug 3, 2023A SQL injection vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows authenticated users to inject arbitrary SQL directives into an SQL statemenCVE-2023-33366 · Other software · Supremainc · reported by MITREHigh 8.8
A SQL injection vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows authenticated users to inject arbitrary SQL directives into an SQL statement and execute arbitrary SQL commands.
Product
Biostar 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record claroty.com kb.supremainc.com
Aug 3, 2023A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files from the server's web sCVE-2023-33365 · Other software · Supremainc · reported by MITREHigh 7.5
A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files from the server's web server.
Product
Biostar 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record claroty.com kb.supremainc.com
Aug 3, 2023An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioStaCVE-2023-33364 · Other software · Supremainc · reported by MITREHigh 8.8
An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioStar 2 server.
Product
Biostar 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record claroty.com kb.supremainc.com
Aug 3, 2023An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functionality on BioStar 2 seCVE-2023-33363 · Other software · Supremainc · reported by MITREHigh 7.5
An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functionality on BioStar 2 servers.
Product
Biostar 2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record claroty.com kb.supremainc.com
Jul 28, 2023The issue was addressed with improved memory handling.CVE-2023-34425 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023The issue was addressed with improved checks.CVE-2023-38603 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A remote user may be able to cause a denial-of-service.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023A logic issue was addressed with improved checks.CVE-2023-38593 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to cause a denial-of-service.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023The issue was addressed with improved memory handling.CVE-2023-38580 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023A path handling issue was addressed with improved validation.CVE-2023-38565 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to gain root privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023The issue was addressed with improved memory handling.CVE-2023-38425 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.2
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023The issue was addressed with improved memory handling.CVE-2023-38424 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023The issue was addressed with improved memory handling.CVE-2023-38261 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023The issue was addressed with improved memory handling.CVE-2023-38136 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.6 and iPadOS 16.6, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023A logic issue was addressed with improved restrictions.CVE-2023-32416 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5, watchOS 9.6. An app may be able to read sensitive location information.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023The issue was addressed with improved memory handling.CVE-2023-32393 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. Processing web content may lead to arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.gentoo.org support.apple.com
Jul 26, 2023The issue was addressed with improved checks.CVE-2023-38410 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. A user may be able to elevate privileges.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023The issue was addressed with improvements to the file handling protocol.CVE-2023-32437 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.6
The issue was addressed with improvements to the file handling protocol. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to break out of its sandbox.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jul 26, 2023A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0CVE-2023-33308 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection.
Product
FortiProxy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Jul 17, 2023Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockeCVE-2023-3615 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comHigh 8.1
Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection.
Product
Mattermost iOS app
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mattermost.com mattermost.com
Jul 14, 2023PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters.CVE-2023-38350 · Other software · Pnp4nagios · reported by MITREMedium 5.4
PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26.
Product
Pnp4nagios
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 14, 2023PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller.CVE-2023-38349 · Other software · Pnp4nagios · reported by MITREHigh 8.8
PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26.
Product
Pnp4nagios
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 14, 2023Microsoft Edge for iOS Spoofing VulnerabilityCVE-2023-36883 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge for iOS Spoofing Vulnerability
Product
Microsoft Edge for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jul 12, 2023The session restore helper crashed whenever there was no parameter sent to the message handler.CVE-2023-37456 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affects Firefox for iOS < 115.
Product
Firefox for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 12, 2023The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab.CVE-2023-37455 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. This vulnerability affects Firefox for iOS < 115.
Product
Firefox for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 11, 2023An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing CVE-2023-28001 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 4.1
An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API.
Product
FortiOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.com fortiguard.com
Jul 3, 2023 NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause improper input validation by providing configuration information in anCVE-2023-25522 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause improper input validation by providing configuration information in an unexpected format. A successful exploit of this vulnerability may lead to denial of service, information disclosure, and data tampering.
Product
DGX A100/A800
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Jul 3, 2023 NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging a weakness whereby pCVE-2023-25521 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.5
NVIDIA DGX A100/A800 contains a vulnerability in SBIOS where an attacker may cause execution with unnecessary privileges by leveraging a weakness whereby proper input parameter validation is not performed. A successful exploit of this vulnerability may lead to denial of service, information disclosure, and data tampering.
Product
DGX A100/A800
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Jun 30, 2023A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which mightCVE-2023-26299 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.
Product
HP PC products using AMI UEFI Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hp.com support.hp.com
Jun 30, 2023"NewsPicks" App for Android versions 10.4.5 and earlier and "NewsPicks" App for iOS versions 10.4.2 and earlier use hard-coded credentials, which may allow a loCVE-2023-28387 · Other software · NewsPicks, Inc. · reported by vultures@jpcert.or.jpMedium 5.5
"NewsPicks" App for Android versions 10.4.5 and earlier and "NewsPicks" App for iOS versions 10.4.2 and earlier use hard-coded credentials, which may allow a local attacker to analyze data in the app and to obtain API key for an external service.
Product
"NewsPicks" App for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record apps.apple.com jvn.jp
Jun 29, 2023Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.CVE-2023-34658 · Other software · Telegram · reported by MITREMedium 5.3
Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record crsrg.sh exchange.xforce.ibmcloud.com
Jun 29, 2023An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1.CVE-2023-34849 · Other software · Ikuai8 · reported by MITRECritical 9.8
An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1.
Product
Ikuaios
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 23, 2023The issue was addressed with improved bounds checks.CVE-2023-32419 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.5 and iPadOS 16.5. A remote attacker may be able to cause arbitrary code execution.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 23, 2023The issue was addressed with improved checks.CVE-2023-32365 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 2.4
The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, iOS 16.5 and iPadOS 16.5. Shake-to-undo may allow a deleted photo to be re-surfaced without authentication.
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 23, 2023A logic issue was addressed with improved checks.CVE-2022-46715 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to bypass certain Privacy preferences
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 23, 2023This issue was addressed with improved data protection.CVE-2022-42792 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed with improved data protection. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to read sensitive location information
Product
iOS and iPadOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.apple.com support.apple.com
Jun 23, 2023 Dell BIOS contains an Improper Input Validation vulnerability.CVE-2023-32480 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell BIOS contains an Improper Input Validation vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability to perform arbitrary code execution.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 23, 2023 Dell BIOS contains an improper authentication vulnerability.CVE-2023-28073 · Other software · Dell · reported by security_alert@emc.comHigh 8.2
Dell BIOS contains an improper authentication vulnerability. A locally authenticated malicious user may potentially exploit this vulnerability by bypassing certain authentication mechanisms in order to elevate privileges on the system.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 23, 2023 Dell BIOS contains an Out-of-bounds Write vulnerability.CVE-2023-28064 · Other software · Dell · reported by security_alert@emc.comLow 3.5
Dell BIOS contains an Out-of-bounds Write vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial of service.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 23, 2023 Dell BIOS contains an improper input validation vulnerability.CVE-2023-28060 · Other software · Dell · reported by security_alert@emc.comMedium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 23, 2023 Dell BIOS contains an improper input validation vulnerability.CVE-2023-28058 · Other software · Dell · reported by security_alert@emc.comMedium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 23, 2023 Dell BIOS contains an improper input validation vulnerability.CVE-2023-28050 · Other software · Dell · reported by security_alert@emc.comMedium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 23, 2023 Dell BIOS contains an improper input validation vulnerability.CVE-2023-28044 · Other software · Dell · reported by security_alert@emc.comMedium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 23, 2023 Dell BIOS contains an improper input validation vulnerability.CVE-2023-28036 · Other software · Dell · reported by security_alert@emc.comMedium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 23, 2023 Dell BIOS contains an improper input validation vulnerability.CVE-2023-28034 · Other software · Dell · reported by security_alert@emc.comMedium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 23, 2023 Dell BIOS contains an improper input validation vulnerability.CVE-2023-28031 · Other software · Dell · reported by security_alert@emc.comMedium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com
Jun 23, 2023 Dell BIOS contains an improper input validation vulnerability.CVE-2023-28027 · Other software · Dell · reported by security_alert@emc.comMedium 5.1
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable.
Product
CPG BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dell.com dell.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.