Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,281 results · page 1 of 26
Sep 24, 2026Out-of-bounds read vulnerability in the graphics module.CVE-2026-81645 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 21, 2026The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView.CVE-2026-90860 · Other software · Canva · reported by 61adb53e-e4b3-47f7-8a93-4717c9e77dc6High 7.1
The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.
- Product
- Canva
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ snd_harmony_create() registers the ICVE-2026-89980 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.4
In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ snd_harmony_create() registers the IRQ before initializing h->lock and h->mixer_lock. A pending interrupt can invoke the handler while these locks are uninitialized. Initialize both locks before requesting the IRQ so the handler always sees valid lock state.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Sep 9, 2026Out-of-bounds read vulnerability in the graphics module.CVE-2026-81647 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 9, 2026Out-of-bounds read vulnerability in the graphics module.CVE-2026-81646 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 9, 2026DoS vulnerability in the preview service module.CVE-2026-81644 · Other software · Huawei · reported by psirt@huawei.comMedium 4.3
DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 9, 2026DoS vulnerability in the input device module.CVE-2026-49315 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 9, 2026OOB write vulnerability in the rendering and composition module.CVE-2026-49314 · Other software · Huawei · reported by psirt@huawei.comHigh 7.3
OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 9, 2026Permission control vulnerability in the app lock module.CVE-2026-49313 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Permission control vulnerability in the window module.CVE-2026-49312 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 9, 2026Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-49311 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 9, 2026Permission control vulnerability in the event notification module.CVE-2026-49310 · Other software · Huawei · reported by psirt@huawei.comHigh 8.6
Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 9, 2026Permission control vulnerability in the Settings module.CVE-2026-49309 · Other software · Huawei · reported by psirt@huawei.comMedium 4.8
Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Permission control vulnerability in the app management module.CVE-2026-41987 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Sep 1, 2026A vulnerability was found in Cleo Harmony up to 5.8.1.10.CVE-2026-84115 · Other software · Cleo · reported by VulDBMedium 5.5
A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.
- Product
- Harmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.cleo.comvuldb.com
Sep 1, 2026A vulnerability has been found in Cleo Harmony up to 5.8.1.10.CVE-2026-84114 · Other software · Cleo · reported by VulDBLow 2.1
A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.
- Product
- Harmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.cleo.comvuldb.com
Aug 17, 2026Null pointer dereference issue in the image codec module.CVE-2026-58561 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 17, 2026Null pointer dereference issue in the image codec module.CVE-2026-58560 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 17, 2026Permission control vulnerability in the clipboard module.CVE-2026-49308 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 17, 2026Permission control vulnerability in the multi-mode input module.CVE-2026-49307 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 17, 2026UAF vulnerability in the time and time zone module.CVE-2026-49306 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 17, 2026Permission control vulnerability in the Wi-Fi enhancement module.CVE-2026-49305 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 17, 2026Permission control vulnerability in the device key management module.CVE-2026-49304 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 17, 2026Permission control vulnerability in the notification module.CVE-2026-49303 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Permission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 17, 2026Permission control vulnerability in the notification service module.CVE-2026-49302 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 17, 2026Permission control vulnerability in the Gallery module.CVE-2026-49301 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jul 15, 2026DoS vulnerability in the vibration service.CVE-2026-58559 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- Harmony OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Permission control vulnerability in the file system.CVE-2026-58558 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- Harmony OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jul 15, 2026Design defect vulnerability in Expedition mode.CVE-2026-58557 · Other software · Huawei · reported by psirt@huawei.comMedium 4.8
Design defect vulnerability in Expedition mode. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Permission control vulnerability in the Bluetooth module.CVE-2026-58556 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- Harmony OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Permission bypass vulnerability in the card module.CVE-2026-58555 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
Permission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jul 15, 2026Permission control vulnerability in the Settings module.CVE-2026-58554 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2026Out-of-bounds read vulnerability in the image codec module.CVE-2026-58553 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jul 15, 2026Out-of-bounds read vulnerability in the image codec module.CVE-2026-58552 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jul 15, 2026Out-of-bounds read vulnerability in the image codec module.CVE-2026-58551 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jul 15, 2026Out-of-bounds read vulnerability in the image codec module.CVE-2026-58550 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jul 15, 2026Out-of-bounds read vulnerability in the image codec module.CVE-2026-58549 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026Logic bypass vulnerability in the file system.CVE-2026-41986 · Other software · Huawei · reported by psirt@huawei.comLow 2.4
Logic bypass vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026UAF vulnerability in the package management module.CVE-2026-41985 · Other software · Huawei · reported by psirt@huawei.comMedium 5.1
UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026UAF vulnerability in the package management module.CVE-2026-41984 · Other software · Huawei · reported by psirt@huawei.comMedium 5.2
UAF vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026Null pointer dereference vulnerability in the browser module.CVE-2026-41983 · Other software · Huawei · reported by psirt@huawei.comMedium 4.3
Null pointer dereference vulnerability in the browser module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026Race condition vulnerability in the IPC module.CVE-2026-41982 · Other software · Huawei · reported by psirt@huawei.comMedium 6.4
Race condition vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026Out-of-bounds write vulnerability in the IPC module.CVE-2026-41981 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Out-of-bounds write vulnerability in the IPC module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026DoS vulnerability in the log service.CVE-2026-41977 · Other software · Huawei · reported by psirt@huawei.comMedium 5
DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026Permission control vulnerability in the audio framework.CVE-2026-41976 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
Permission control vulnerability in the audio framework. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026Permission control vulnerability in service notifications.CVE-2026-41974 · Other software · Huawei · reported by psirt@huawei.comLow 3.6
Permission control vulnerability in service notifications. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026Permission control vulnerability in calls.CVE-2026-41973 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Path traversal vulnerability in the SMS app.CVE-2026-41972 · Other software · Huawei · reported by psirt@huawei.comMedium 5.4
Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Permission control vulnerability in the file preview module.CVE-2026-41980 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Permission control vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jun 9, 2026Permission control vulnerability in the print module.CVE-2026-41979 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect integrity and confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.