Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,281 results · page 9 of 26
Feb 7, 2025in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use afterCVE-2025-0304 · Other software · OpenHarmony · reported by scy@openharmony.ioHigh 8.8
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through buffer ovCVE-2025-0303 · Other software · OpenHarmony · reported by scy@openharmony.ioHigh 8.8
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through buffer overflow.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through integer overflow.CVE-2025-0302 · Other software · OpenHarmony · reported by scy@openharmony.ioMedium 5.5
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through integer overflow.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-57962 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.CVE-2024-57961 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-57960 · Other software · Huawei · reported by psirt@huawei.comHigh 7.7
Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.CVE-2024-57959 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.CVE-2024-57958 · Other software · Huawei · reported by psirt@huawei.comMedium 5.7
Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confidentiCVE-2024-57957 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-57956 · Other software · Huawei · reported by psirt@huawei.comLow 2.8
Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-57955 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-57954 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-12602 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability mayCVE-2024-56456 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability mayCVE-2024-56455 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability mayCVE-2024-56454 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability mayCVE-2024-56453 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability mayCVE-2024-56452 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-56451 · Other software · Huawei · reported by psirt@huawei.comHigh 7.3
Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-56450 · Other software · Huawei · reported by psirt@huawei.comMedium 6.3
Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56449 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-56448 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.CVE-2024-54121 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affect service confidentiCVE-2024-56447 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-56446 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause features to perform abCVE-2024-56445 · Other software · Huawei · reported by psirt@huawei.comMedium 4.3
Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56444 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56443 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to performCVE-2024-56442 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56441 · Other software · Huawei · reported by psirt@huawei.comMedium 4.1
Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.CVE-2024-56440 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56439 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-56438 · Other software · Huawei · reported by psirt@huawei.comMedium 6
Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availabilitCVE-2024-56437 · Other software · Huawei · reported by psirt@huawei.comMedium 5.7
Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Race condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerability may cause features to perform abnormalCVE-2024-54120 · Other software · Huawei · reported by psirt@huawei.comMedium 4.1
Race condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform abCVE-2023-52955 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of improper permission control in the Gallery module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2023-52954 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Vulnerability of improper permission control in the Gallery module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.CVE-2023-52953 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56436 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56435 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of the device.CVE-2024-56434 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of the device.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through use after free.CVE-2024-54030 · Other software · OpenHarmony · reported by scy@openharmony.ioMedium 4.4
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through use after free.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the device is unable to boot up through out-of-bounds write.CVE-2024-47398 · Other software · OpenHarmony · reported by scy@openharmony.ioHigh 8.8
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the device is unable to boot up through out-of-bounds write.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025in OpenHarmony v4.1.2 and prior versions allow a local attacker cause information leak through out-of-bounds Read.CVE-2024-45070 · Other software · OpenHarmony · reported by scy@openharmony.ioMedium 5.5
in OpenHarmony v4.1.2 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2024Some Huawei home music system products have a path traversal vulnerability.CVE-2023-7263 · Other software · Huawei · reported by psirt@huawei.comHigh 7.3
Some Huawei home music system products have a path traversal vulnerability. Successful exploitation of this vulnerability may cause unauthorized file deletion or file permission change.(Vulnerability ID:HWPSIRT-2023-53450) This vulnerability has been assigned a (CVE)ID:CVE-2023-7263
- Product
- HarmonyOS AILife Solution 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2024Huawei HiLink AI Life product has an identity authentication bypass vulnerability.CVE-2022-48470 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Huawei HiLink AI Life product has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions.(Vulnerability ID:HWPSIRT-2022-42291) This vulnerability has been assigned a (CVE)ID:CVE-2022-48470
- Product
- HarmonyOS AILife Solution 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2024Some Huawei wearables have a permission management vulnerability.CVE-2021-37000 · Other software · Huawei · reported by psirt@huawei.comHigh 7.7
Some Huawei wearables have a permission management vulnerability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2024Some Huawei wearables have a vulnerability of not verifying the actual data size when reading data.CVE-2021-22484 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Some Huawei wearables have a vulnerability of not verifying the actual data size when reading data. Successful exploitation of this vulnerability may cause a server out of memory (OOM).
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Huawei Home Music System has a path traversal vulnerability.CVE-2023-7300 · Other software · Huawei · reported by psirt@huawei.comHigh 8
Huawei Home Music System has a path traversal vulnerability. Successful exploitation of this vulnerability may cause the music host file to be deleted or the file permission to be changed.(Vulnerability ID:HWPSIRT-2023-60613)
- Product
- HarmonyOS AILife Solution 8.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2024CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs maCVE-2024-11999 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.7
CWE-1104: Use of Unmaintained Third-Party Components vulnerability exists that could cause complete control of the device when an authenticated user installs malicious code into HMI product.
- Product
- Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with EcoStruxure Operator Terminal Expert runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.