Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

14 results

Oct 21, 2026Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android.CVE-2026-70387 · Other software · OnePlus · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.4
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
Product
OxygenOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.nns.ee
Oct 21, 2026Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on AndroiCVE-2026-70386 · Other software · OnePlus · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.5
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
Product
OxygenOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.nns.ee
Sep 23, 2025The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permissioCVE-2025-10184 · Other software · OnePlus · reported by cve@rapid7.comHigh 8.2
The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks. The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers.
Product
OxygenOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record assets.contentstack.io rapid7.com
Mar 29, 2018An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier.CVE-2017-5947 · Other software · Oneplus · reported by MITREMedium 6.8
An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergency Download (EDL) mode through ADB or by using Volume-Up when connected to USB, which in turn could allow for downgrading partitions such as the Android Bootloader.
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com alephsecurity.com
May 11, 2017An issue was discovered on OnePlus One and X devices.CVE-2017-8851 · Other software · Oneplus · reported by MITREMedium 5.9
An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X OTA images, the fact that both products use the same OTA verification keys, and the fact that both products share the same 'ro.build.product' system property, attackers can install OTAs of one product over the other, even on locked bootloaders. That could theoretically allow for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. Moreover, the vulnerability may result in having the device unusable until a Factory Reset is performed. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA.
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com alephsecurity.com
May 11, 2017An issue was discovered on OnePlus One, X, 2, 3, and 3T devices.CVE-2017-8850 · Other software · Oneplus · reported by MITREMedium 5.9
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com alephsecurity.com
May 11, 2017An issue was discovered on OnePlus One, X, 2, 3, and 3T devices.CVE-2017-5948 · Other software · Oneplus · reported by MITREMedium 5.9
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com alephsecurity.com
May 11, 2017An issue was discovered on OnePlus devices such as the 3T.CVE-2016-10370 · Other software · Oneplus · reported by MITREHigh 7.5
An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851.
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com alephsecurity.com
Apr 25, 2017In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbiCVE-2017-5625 · Other software · Oneplus · reported by MITREMedium 4.6
In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition (except 'keystore') by issuing the 'fastboot oem dump <partition>' fastboot command.
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record alephsecurity.com alephsecurity.com
Mar 26, 2017With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled.CVE-2017-5622 · Other software · Oneplus · reported by MITREMedium 5.9
With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other vulnerabilities and/or exfiltrate sensitive information.
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com alephsecurity.com
Mar 19, 2017An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices.CVE-2017-5623 · Other software · Oneplus · reported by MITREMedium 6.6
An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem boot_mode {rf/wlan/ftm/normal} command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any security-sensitive operation to be run unless the bootloader is unlocked.
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com alephsecurity.com
Mar 12, 2017OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootCVE-2017-5626 · Other software · Oneplus · reported by MITRECritical 9.8
OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code execution with high privileges (kernel/root) with complete access to user data.
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityresear.ch securityresear.ch
Mar 12, 2017An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T.CVE-2017-5624 · Other software · Oneplus · reported by MITRECritical 9.8
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the (locked) bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disable_dm_verity' command. Having dm-verity disabled, the kernel will not verify the system partition (and any other dm-verity protected partition), which may allow for persistent code execution and privilege escalation.
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityresear.ch securityresear.ch
Jan 23, 2017An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2.CVE-2017-5554 · Other software · Oneplus · reported by MITREHigh 8.1
An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can issue the adb reboot bootloader command. Then, the attacker can put the platform's SELinux in permissive mode, which severely weakens it, by issuing: fastboot oem selinux permissive.
Product
Oxygenos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securityresear.ch

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.