Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Apr 14, 2025Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux.CVE-2025-31344 · Other software · openEuler · reported by securities@openeuler.orgHigh 7.3
Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This issue affects giflib: through 5.2.2.
- Product
- giflib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitee.comopeneuler.org
Apr 15, 2024Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure.CVE-2024-24898 · Other software · openEuler · reported by securities@openeuler.orgMedium 6
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C. This issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.
- Product
- kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure.CVE-2024-24891 · Other software · openEuler · reported by securities@openeuler.orgMedium 6
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in openEuler kernel on Linux allows Resource Leak Exposure. This vulnerability is associated with program files https://gitee.Com/openeuler/kernel/blob/openEuler-1.0-LTS/drivers/staging/gmjstcm/tcm.C. This issue affects kernel: from 4.19.90-2109.1.0.0108 before 4.19.90-2403.4.0.0244.
- Product
- kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command InjectioCVE-2024-24899 · Other software · openEuler · reported by securities@openeuler.orgHigh 7.2
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-zeus on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/aops-zeus/blob/master/zeus/conf/constant.Py. This issue affects aops-zeus: from 1.2.0 through 1.4.0.
- Product
- aops-zeus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command InjectioCVE-2024-24897 · Other software · openEuler · reported by securities@openeuler.orgHigh 8.1
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/blob/master/atune_collector/plugin/monitor/process/sched.Py. This issue affects A-Tune-Collector: from 1.1.0-3 through 1.3.0.
- Product
- A-Tune-Collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-tCVE-2024-24892 · Other software · openEuler · reported by securities@openeuler.orgHigh 8.1
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-tools on Linux allows Command Injection, Restful Privilege Elevation. This vulnerability is associated with program files https://gitee.Com/openeuler/migration-tools/blob/master/index.Py. This issue affects migration-tools: from 1.0.0 through 1.0.1.
- Product
- migration-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitee.comopeneuler.org
Mar 25, 2024Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command InjectCVE-2024-24890 · Other software · openEuler · reported by securities@openeuler.orgHigh 7.8
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler gala-gopher on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/gala-gopher/blob/master/src/probes/extends/ebpf.Probe/src/ioprobe/ioprobe.C. This issue affects gala-gopher: through 1.0.2.
- Product
- gala-gopher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race CondiCVE-2021-33632 · Other software · openEuler · reported by securities@openeuler.orgHigh 7
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This vulnerability is associated with program files https://gitee.Com/openeuler/iSulad/blob/master/src/cmd/isulad/main.C. This issue affects iSulad: 2.0.18-13, from 2.1.4-1 through 2.1.4-2.
- Product
- iSulad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2024Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command InjectiCVE-2021-33633 · Other software · openEuler · reported by securities@openeuler.orgHigh 7.3
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py. This issue affects aops-ceres: from 1.3.0 through 1.4.1.
- Product
- aops-ceres
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2024Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kerneCVE-2021-33631 · Other software · openEuler · reported by securities@openeuler.orgMedium 5.5
Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3, from 5.10.0-60.18.0 before 5.10.0-183.0.0.
- Product
- kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 18, 2024NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation.CVE-2021-33630 · Other software · openEuler · reported by securities@openeuler.orgMedium 5.5
NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is associated with program files net/sched/sch_cbs.C. This issue affects openEuler kernel: from 4.19.90 before 4.19.90-2401.3.
- Product
- kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Oct 29, 2023 When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attacker can escape the CVE-2021-33638 · Other software · openEuler · reported by securities@openeuler.orgHigh 8.4
When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attacker can escape the container.
- Product
- iSulad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2023 When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can escape the container.CVE-2021-33637 · Other software · openEuler · reported by securities@openeuler.orgHigh 8.4
When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can escape the container.
- Product
- iSulad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2023 When the isula load command is used to load malicious images, attackers can execute arbitrary code.CVE-2021-33636 · Other software · openEuler · reported by securities@openeuler.orgHigh 8.4
When the isula load command is used to load malicious images, attackers can execute arbitrary code.
- Product
- iSulad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2023When malicious images are pulled by isula pull, attackers can execute arbitrary code.CVE-2021-33635 · Other software · openEuler · reported by securities@openeuler.orgCritical 9.8
When malicious images are pulled by isula pull, attackers can execute arbitrary code.
- Product
- iSulad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2023iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.CVE-2021-33634 · Other software · openEuler · reported by securities@openeuler.orgMedium 6.3
iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.
- Product
- lcr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2023REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified.CVE-2021-33639 · Other software · Openatom · reported by securities@openeuler.orgHigh 7.5
REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified.
- Product
- Openeuler Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function.CVE-2021-33642 · Other software · Openeuler · reported by securities@openeuler.orgMedium 5.5
When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function.
- Product
- Byacc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023When processing files, malloc stores the data of the current line.CVE-2021-33641 · Other software · Openeuler · reported by securities@openeuler.orgHigh 7.8
When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory (use after free).
- Product
- Byacc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022After tar_close(), libtar.c releases the memory pointed to by pointer t.CVE-2021-33640 · Other software · openEuler · reported by securities@openeuler.orgMedium 6.2
After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).
- Product
- openEuler 22.03 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jul 18, 2022When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.CVE-2021-33656 · Other software · Openatom · reported by securities@openeuler.orgMedium 6.8
When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
- Product
- Openeuler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgit.kernel.org
Mar 11, 2022atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file.CVE-2021-33658 · Other software · openEuler · reported by securities@openeuler.orgHigh 7.8
atune before 0.3-0.8 log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file. Authentication is not forcibly enabled in the default configuration.
- Product
- atune
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopeneuler.orgopeneuler.org
Jul 26, 2021isula-build before 0.9.5-6 can cause a program crash, when building container images, some functions for processing external data do not remove spaces when procCVE-2021-33629 · Other software · Openeuler · reported by securities@openeuler.orgHigh 7.5
isula-build before 0.9.5-6 can cause a program crash, when building container images, some functions for processing external data do not remove spaces when processing data.
- Product
- Isula-build
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopeneuler.orgopeneuler.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.