Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31 results
Sep 2, 2026A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary CVE-2023-20577 · Other software · AMD · reported by psirt@amd.comHigh 7.4
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.
- Product
- 2nd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, CVE-2023-31315 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamd.commedia.defcon.org
Aug 5, 2024Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in lCVE-2024-21980 · Other software · AMD · reported by psirt@amd.comHigh 7.9
Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC seed resulting in loss of confidentiality and integrity.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruptionCVE-2024-21978 · Other software · AMD · reported by psirt@amd.comMedium 6
Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakage or data corruption.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2024Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allowing reading of memoCVE-2023-31355 · Other software · AMD · reported by psirt@amd.comMedium 6
Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allowing reading of memory from a decommissioned guest.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when Secure TSC is enabledCVE-2023-31347 · Other software · AMD · reported by psirt@amd.comMedium 4.9
Due to a code bug in Secure_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when Secure TSC is enabled potentially resulting in a loss of guest integrity.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.CVE-2023-31346 · Other software · AMD · reported by psirt@amd.comMedium 6
Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2024Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leading to arbitrary code execution.CVE-2023-20587 · Other software · AMD · reported by psirt@amd.comHigh 7.1
Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leading to arbitrary code execution.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2024A privileged attacker can prevent delivery of debug exceptions to SEV-SNP guests potentially resulting in guests not receiving expected debug information.CVE-2023-20573 · Other software · AMD · reported by psirt@amd.comLow 3.2
A privileged attacker can prevent delivery of debug exceptions to SEV-SNP guests potentially resulting in guests not receiving expected debug information.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavCVE-2023-20592 · Other software · AMD · reported by psirt@amd.comMedium 6.5
Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of guest virtual machine (VM) memory integrity.
- Product
- 1st Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest memory integrity.CVE-2023-20566 · Other software · AMD · reported by psirt@amd.comMedium 5.3
Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest memory integrity.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious hypervisor to masquerade as the guest's migration agent resuCVE-2023-20519 · Other software · AMD · reported by psirt@amd.comLow 3.3
A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious hypervisor to masquerade as the guest's migration agent resulting in a potential loss of guest integrity.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.CVE-2022-23830 · Other software · AMD · reported by psirt@amd.comLow 1.9
SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity.
- Product
- 3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read potentially resulting CVE-2021-26345 · Other software · AMD · reported by psirt@amd.comLow 1.9
Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read potentially resulting in a denial of service.
- Product
- 2nd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023 A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a pCVE-2023-20575 · Other software · AMD · reported by psirt@amd.comMedium 6.5
A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information.
- Product
- 1st Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially rCVE-2022-27672 · Other software · AMD · reported by psirt@amd.comMedium 4.7
When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure.
- Product
- 1st Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgamd.com
May 11, 2022Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resultiCVE-2021-26388 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.CVE-2021-26378 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial oCVE-2021-26376 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could resultCVE-2021-26375 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could result in denial of service.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possiblCVE-2021-26373 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possibly denial of service.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of seCVE-2021-26372 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which could result in an eCVE-2021-26364 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which could result in an exception handling leading to a potential denial of service.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in a potential denial oCVE-2021-26350 · Other software · AMD · reported by psirt@amd.comMedium 4.7
A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in a potential denial of service.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (MACVE-2021-26349 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (MA).
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be ableCVE-2021-26348 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includes creation of a newCVE-2021-26342 · Other software · AMD · reported by psirt@amd.comLow 3.3
In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includes creation of a new virtual machine control block (VMCB). The failure to flush the TLB may cause the microcode to use stale TLB translations which may allow for disclosure of SEV guest memory contents. Users of SEV-ES/SEV-SNP guest VMs are not impacted by this vulnerability.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denialCVE-2021-26339 · Other software · AMD · reported by psirt@amd.comMedium 5.5
A bug in AMD CPU’s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denial of service. AMD believes the specific code includes a specific x86 instruction sequence that would not be generated by compilers.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encrypted State (SEV-ES) and Secure Encrypted VCVE-2020-12966 · Other software · AMD · reported by psirt@amd.comMedium 5.5
AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encrypted State (SEV-ES) and Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP). A local authenticated attacker could potentially exploit this vulnerability leading to leaking guest data by the malicious hypervisor.
- Product
- 1st/2nd/3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be ableCVE-2021-26312 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.
- Product
- EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2021A potential denial of service (DoS) vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system when it is rebooted.CVE-2020-12988 · Other software · AMD · reported by psirt@amd.comHigh 7.5
A potential denial of service (DoS) vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system when it is rebooted.
- Product
- 1st/2nd/3rd Gen AMD EPYC™ Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.