Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Jul 8, 2025A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitiCVE-2024-36357 · Other software · AMD · reported by psirt@amd.comMedium 5.6
A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.
- Product
- AMD EPYC™ 7003 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of priCVE-2024-36350 · Other software · AMD · reported by psirt@amd.comMedium 5.6
A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.
- Product
- AMD EPYC™ 7003 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, potentially resulting inCVE-2024-36349 · Other software · AMD · reported by psirt@amd.comLow 3.8
A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, potentially resulting in information leakage.
- Product
- AMD EPYC™ 7002 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2025A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enabledCVE-2024-36348 · Other software · AMD · reported by psirt@amd.comLow 3.8
A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enabled, potentially resulting in information leakage.
- Product
- AMD EPYC™ 7002 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023 A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.CVE-2023-20588 · Other software · AMD · reported by psirt@amd.comMedium 5.5
A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.
- Product
- EPYC™ 7001 Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Aug 1, 2023A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache lCVE-2023-20583 · Other software · AMD · reported by psirt@amd.comMedium 4.7
A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache line changes over time potentially resulting in a leak of sensitive information.
- Product
- Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023 A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a pCVE-2023-20575 · Other software · AMD · reported by psirt@amd.comMedium 6.5
A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information.
- Product
- 1st Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially rCVE-2022-27672 · Other software · AMD · reported by psirt@amd.comMedium 4.7
When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure.
- Product
- 1st Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgamd.com
Nov 9, 2022IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure.CVE-2022-23824 · Other software · AMD · reported by psirt@amd.comMedium 5.5
IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.fedoraproject.org
Aug 10, 2022Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that useCVE-2021-46778 · Other software · AMD · reported by psirt@amd.comMedium 5.6
Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading (SMT). By measuring the contention level on scheduler queues an attacker may potentially leak sensitive information.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.CVE-2022-23825 · Other software · AMD · reported by psirt@amd.comMedium 6.5
Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information disclosure.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jul 12, 2022Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.CVE-2022-29900 · Other software · AMD · reported by psirt@amd.comMedium 6.5
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Jun 15, 2022A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable inCVE-2022-23823 · Other software · AMD · reported by psirt@amd.comMedium 6.5
A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable information disclosure.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time.CVE-2021-46744 · Other software · AMD · reported by psirt@amd.comMedium 6.5
An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memorCVE-2021-26400 · Other software · AMD · reported by psirt@amd.comMedium 4
AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memory, resulting in potential data leakage.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.CVE-2021-26401 · Other software · AMD · reported by psirt@amd.comMedium 5.6
LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.CVE-2021-26341 · Other software · AMD · reported by psirt@amd.comMedium 6.5
Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021Improper handling of pointers in the System Management Mode (SMM) handling code may allow for a privileged attacker with physical or administrative access to poCVE-2020-12890 · Other software · AMD · reported by psirt@amd.comMedium 6.7
Improper handling of pointers in the System Management Mode (SMM) handling code may allow for a privileged attacker with physical or administrative access to potentially manipulate the AMD Generic Encapsulated Software Architecture (AGESA) to execute arbitrary code undetected by the operating system.
- Product
- AMD Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2017Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD processors.CVE-2017-5926 · Other software · Allwinner · reported by MITREHigh 7.5
Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD processors. By performing a side-channel attack on the MMU operations, it is possible to leak data and code pointers from JavaScript, breaking ASLR.
- Product
- A64
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcs.vu.nlsecurityfocus.com
Apr 20, 2006The Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and 8th generation AuthenticAMD processors, only save/restore the FCVE-2006-1056 · Other software · Freebsd · reported by Red HatLow 2.1
The Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and 8th generation AuthenticAMD processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one process to determine portions of the state of floating point instructions of other processes, which can be leveraged to obtain sensitive information such as cryptographic keys. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.
- Product
- Freebsd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordftp.freebsd.orgkb.vmware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.