Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Oct 22, 2026Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths.CVE-2026-115390 · Other software · bytecodealliance · reported by VulnCheckMedium 6.9
Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths. Malicious guests can reset consumed fuel after calls to run exponentially long on linear fuel, evading timeouts and periodic yields for denial of service.
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 23, 2026NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation.CVE-2026-42801 · Other software · ASR · reported by 68630edc-a58c-4cbd-9b01-0e130455c8aeHigh 7.4
NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c.
- Product
- Crane，Falcon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege.CVE-2024-34679 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.com
Apr 16, 2024An unsigned value can never be negative, so eMMC full disk test will always evaluate the same way.CVE-2024-32633 · Other software · ASR · reported by 68630edc-a58c-4cbd-9b01-0e130455c8aeMedium 4
An unsigned value can never be negative, so eMMC full disk test will always evaluate the same way.
- Product
- Falcon/Crane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasrmicro.comasrmicro.com
Apr 16, 2024A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory accessCVE-2024-32632 · Other software · ASR · reported by 68630edc-a58c-4cbd-9b01-0e130455c8aeMedium 6.6
A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory access
- Product
- Falcon/Crane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasrmicro.comasrmicro.com
Apr 16, 2024Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations.CVE-2024-32631 · Other software · ASR · reported by 68630edc-a58c-4cbd-9b01-0e130455c8aeHigh 7.2
Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations.
- Product
- Falcon/Crane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasrmicro.comasrmicro.com
Apr 16, 2024In OffloadAMRWriter, a scalar field is not initialized so will contain an arbitrary value left over from earlier computationsCVE-2024-32625 · Other software · ASR · reported by 68630edc-a58c-4cbd-9b01-0e130455c8aeMedium 5.8
In OffloadAMRWriter, a scalar field is not initialized so will contain an arbitrary value left over from earlier computations
- Product
- Falcon/Crane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasrmicro.comasrmicro.com
Jun 19, 2023Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in FirefCVE-2023-32216 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
Mar 31, 2022Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift.CVE-2022-24791 · Other software · bytecodealliance · reported by GitHubHigh 8.1
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. Cold blocks are emitted at the end of compiled functions, and change the order blocks are emitted versus defined. This reordering accidentally caused Cranelift to skip emitting some stack maps because it expected to emit the stack maps in block definition order, rather than block emission order. When Wasmtime would eventually collect garbage, it would fail to find live references on the stack because of the missing stack maps, think that they were unreferenced garbage, and therefore reclaim them. Then after the collection ended, the Wasm code could use the reclaimed-too-ea
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2021Cranelift is an open-source code generator maintained by Bytecode Alliance.CVE-2021-32629 · Other software · bytecodealliance · reported by GitHubHigh 7.2
Cranelift is an open-source code generator maintained by Bytecode Alliance. It translates a target-independent intermediate representation into executable machine code. There is a bug in 0.73 of the Cranelift x64 backend that can create a scenario that could result in a potential sandbox escape in a Wasm program. This bug was introduced in the new backend on 2020-09-08 and first included in a release on 2020-09-30, but the new backend was not the default prior to 0.73. The recently-released version 0.73 with default settings, and prior versions with an explicit build flag to select the new backend, are vulnerable. The bug in question performs a sign-extend instead of a zero-extend on a value loaded from the stack, under a specific set of circumstances. If those circumstances occur, the bug could allow access to memory addresses upto 2GiB before the start of the Wasm program heap. If the heap bound is larger than 2GiB, then it would be possible to read memory from a computable range dependent on the size of the heaps bound. The impact of this bug is highly dependent on heap implementation, specifically: * if the heap has bounds checks, and * does not rely exclusively on guard pages,
- Product
- wasmtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2021The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise.CVE-2020-27637 · Other software · R-project · reported by MITRECritical 9.8
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
- Product
- Cran
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.bishopfox.comsecurity.gentoo.org
Oct 24, 2018All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission.CVE-2018-17935 · Other software · Telecrane · reported by ics-cert@hq.dhs.govHigh 8.1
All versions of Telecrane F25 Series Radio Controls before 00.0A use fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized replay of a command, spoofing of an arbitrary message, or keeping the controlled load in a permanent "stop" state.
- Product
- F25 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Jul 4, 2018The mintToken function of a smart contract implementation for Cranoo (CRN), an Ethereum token, has an integer overflow that allows the owner of the contract to CVE-2018-13195 · Other software · Cranooadvanced Project · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for Cranoo (CRN), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Cranooadvanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2014The Realtime Music Rank (aka com.blogspot.imapp.immusicrank2) application 5.5 for Android does not verify X.509 certificates from SSL servers, which allows man-CVE-2014-7506 · Other software · Imapp · reported by cret@cert.orgMedium 5.4
The Realtime Music Rank (aka com.blogspot.imapp.immusicrank2) application 5.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Realtime Music Rank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 8, 2014The brokenscreencrank (aka com.biggame.brokenscreencrank) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-tCVE-2014-5587 · Other software · Brokenscreencrank Project · reported by cret@cert.orgMedium 5.4
The brokenscreencrank (aka com.biggame.brokenscreencrank) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Brokenscreencrank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Nov 17, 2013The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrarCVE-2013-4557 · Other software · Spip · reported by Red HatHigh 7.5
The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.
- Product
- Spip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.