Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Jul 27, 2026Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system.CVE-2025-59180 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfMedium 5.1
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information.
- Product
- Packet Core Controller (PCC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2026The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing only 64 possible combinations.CVE-2026-2541 · Other software · Micca Auto Electronics Co., Ltd. · reported by cve@asrg.ioMedium 6.4
The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing only 64 possible combinations. This low entropy allows an attacker to perform a brute-force attack against one component of the rolling code. Successful exploitation simplify an attacker to predict the next valid rolling code, granting unauthorized access to the vehicle.
- Product
- Car Alarm System KE700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2026The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks.CVE-2026-2540 · Other software · Micca Auto Electronics Co., Ltd. · reported by cve@asrg.ioHigh 8.4
The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previously used (stale) rolling codes and execute a command. Successful exploitation allows an attacker to clone the alarm key. This grants the attacker unauthorized access to the vehicle to unlock or lock the doors.
- Product
- Car Alarm System KE700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2026The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames.CVE-2026-2539 · Other software · Micca Auto Electronics Co., Ltd. · reported by cve@asrg.ioMedium 5.7
The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames. An attacker with a radio interception tool (e.g., SDR) can capture the random number and counters transmitted in cleartext, which is sensitive information required for authentication.
- Product
- Car Alarm System KE700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack.CVE-2025-67135 · Other software · reported by MITRECritical 9.8
Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML fileCVE-2025-15114 · Other software · Ksenia Security S.p.A. · reported by VulnCheckCritical 9.3
Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authentication.
- Product
- lares
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulncheck.comzeroscience.mk
Sep 15, 2025The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security.CVE-2025-56448 · Other software · Positron · reported by MITREMedium 6.8
The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. The alarm system does not properly rotate or invalidate used codes, allowing repeated reuse of captured transmissions. This exposes users to significant security risks, including vehicle theft and loss of trust in the alarm's anti-cloning claims.
- Product
- Px360bt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.compositron.com.br
May 19, 2025Tiiwee X1 Alarm System TWX1HAKV2 allows Authentication Bypass by Capture-replay, leading to physical Access to the protected facilities without triggering an alCVE-2025-30072 · Other software · Tiiwee · reported by MITREHigh 7.6
Tiiwee X1 Alarm System TWX1HAKV2 allows Authentication Bypass by Capture-replay, leading to physical Access to the protected facilities without triggering an alarm.
- Product
- Twx1hakv2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which results in an attackCVE-2023-50128 · Other software · Hozard · reported by MITREMedium 5.3
The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which results in an attacker being able to conduct replay attacks to bring the alarm system to a disarmed state.
- Product
- Alarm System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication.CVE-2023-50127 · Other software · Hozard · reported by MITREMedium 5.9
Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionality are accepted from random phone numbers, which allows an attacker to bring the alarm system to a disarmed state from any given phone number.
- Product
- Alarm System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical proximity to one ofCVE-2023-50126 · Other software · Hozard · reported by MITREMedium 6.5
Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical proximity to one of the original tags, which results in an attacker being able to bring the alarm system to a disarmed state.
- Product
- Alarm System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed state.CVE-2023-50125 · Other software · Hozard · reported by MITREMedium 5.9
A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed state.
- Product
- Alarm System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited.CVE-2023-50123 · Other software · Hozard · reported by MITREHigh 8.1
The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. This could allow an attacker to perform a brute force on the SMS authentication, to bring the alarm system to a disarmed state.
- Product
- Alarm System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack.CVE-2023-31759 · Other software · Keruistore · reported by MITREHigh 7.5
Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack.
- Product
- Kerui W18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordashallen.netashallen.net
Dec 15, 2021The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181CVE-2021-40171 · Other software · Securitashome · reported by MITREMedium 5.3
The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to block legitimate traffic while not alerting the owner of the system.
- Product
- Securitashome Alarm System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiva-portal.orgsecuritashome.se
Dec 15, 2021An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to triggerCVE-2021-40170 · Other software · Securitashome · reported by MITREMedium 6.8
An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to trigger arbitrary system functionality by replaying previously recorded signals. This lets an adversary, among other things, disarm an armed system.
- Product
- Securitashome Alarm System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiva-portal.orgsecuritashome.se
Apr 21, 2021The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface.CVE-2020-28973 · Other software · Abus · reported by MITREHigh 7.5
The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system, such as usernames and passwords. This information can then be used to reconfigure or disable the alarm system.
- Product
- Secvest Wireless Alarm System Fuaa50000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeye.securityeye.security
Sep 3, 2019An issue was discovered on ABUS Secvest FUAA50000 3.01.01 devices.CVE-2019-14261 · Other software · Abus · reported by MITREHigh 7.5
An issue was discovered on ABUS Secvest FUAA50000 3.01.01 devices. Due to an insufficient implementation of jamming detection, an attacker is able to suppress correctly received RF messages sent between wireless peripheral components, e.g., wireless detectors or remote controls, and the ABUS Secvest alarm central. An attacker is able to perform a "reactive jamming" attack. The reactive jamming simply detects the start of a RF message sent by a component of the ABUS Secvest wireless alarm system, for instance a wireless motion detector (FUBW50000) or a remote control (FUBE50014 or FUBE50015), and overlays it with random data before the original RF message ends. Thereby, the receiver (alarm central) is not able to properly decode the original transmitted signal. This enables an attacker to suppress correctly received RF messages of the wireless alarm system in an unauthorized manner, for instance status messages sent by a detector indicating an intrusion.
- Product
- Secvest Wireless Alarm System Fuaa50000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
May 14, 2019Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireless alarm system can eCVE-2019-9861 · Other software · Abus · reported by MITREHigh 8.1
Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wireless alarm system can easily be cloned and used to deactivate the alarm system in an unauthorized way.
- Product
- Secvest Wireless Alarm System Fuaa50000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 27, 2019Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote control (FUBE50014 CVE-2019-9860 · Other software · Abus · reported by MITREHigh 7.5
Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remote control (FUBE50014 or FUBE50015) relative to its controlled Secvest wireless alarm system FUAA50000 3.01.01, so that sent commands by the remote control are not accepted anymore.
- Product
- Secvest Wireless Alarm System Fuaa50000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2019Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote controls FUBE50014 and FUBECVE-2019-9863 · Other software · Abus · reported by MITRECritical 9.8
Due to the use of an insecure algorithm for rolling codes in the ABUS Secvest wireless alarm system FUAA50000 3.01.01 and its remote controls FUBE50014 and FUBE50015, an attacker is able to predict valid future rolling codes, and can thus remotely control the alarm system in an unauthorized way.
- Product
- Secvest Wireless Alarm System Fuaa50000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2019An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote control FUBE50014 or FUBE50015.CVE-2019-9862 · Other software · Abus · reported by MITREMedium 6.5
An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote control FUBE50014 or FUBE50015. Because "encrypted signal transmission" is missing, an attacker is able to eavesdrop sensitive data as cleartext (for instance, the current rolling code state).
- Product
- Secvest Wireless Alarm System Fuaa50000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2019The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger the alarm remotely viCVE-2019-9659 · Other software · Chuango · reported by MITRECritical 9.1
The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger the alarm remotely via replay attacks, as demonstrated by Chuango branded products, and non-Chuango branded products such as the Eminent EM8617 OV2 Wifi Alarm System.
- Product
- Wifi Alarm System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2017Vivint Sky Control Panel 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modify other security settings via the Web-enabled interfCVE-2014-8362 · Other software · Vivint · reported by MITRECritical 9.8
Vivint Sky Control Panel 1.1.1.9926 allows remote attackers to enable and disable the alarm system and modify other security settings via the Web-enabled interface.
- Product
- SKY Control Panel Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.