Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
22 results
Oct 12, 2026RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_seCVE-2026-108952 · Other software · RT-Thread · reported by VulnCheckMedium 5.1
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.
- Product
- rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2026A flaw has been found in RT-Thread up to 5.2.2.CVE-2026-14629 · Other software · reported by VulDBLow 2.1
A flaw has been found in RT-Thread up to 5.2.2. Affected is the function read/write/sys_ioctl of the file components/lwp/lwp_syscall.c of the component Parameter Handler. Executing a manipulation can lead to divide by zero. The attack may be launched remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026A weakness has been identified in RT-Thread up to 5.0.2.CVE-2026-14607 · Other software · reported by VulDBMedium 5.4
A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sys_getaddrinfo of the file components/lwp/lwp_syscall.c. Executing a manipulation of the argument ai_addr can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026A security flaw has been discovered in RT-Thread up to 5.0.2.CVE-2026-14606 · Other software · reported by VulDBHigh 7.1
A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CAN_Receive in the library bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler. Performing a manipulation results in stack-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2026A vulnerability was identified in RT-Thread up to 5.0.2.CVE-2026-14605 · Other software · reported by VulDBHigh 7.1
A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the function recvmsg in the library bsp/loongson/ls1cdev/libraries/ls1c_can.h of the component ls1c CAN Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0.CVE-2025-6693 · Other software · Rt-thread · reported by VulDBHigh 8.5
A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_device_open/sys_device_read/sys_device_control/sys_device_init/sys_device_close/sys_device_write of the file components/drivers/core/device.c. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025A vulnerability, which was classified as critical, was found in RT-Thread 5.1.0.CVE-2025-5869 · Other software · Rt-thread · reported by VulDBHigh 8.6
A vulnerability, which was classified as critical, was found in RT-Thread 5.1.0. Affected is the function sys_recvfrom of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument from leads to memory corruption.
- Product
- Rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0.CVE-2025-5868 · Other software · Rt-thread · reported by VulDBHigh 8.6
A vulnerability, which was classified as critical, has been found in RT-Thread 5.1.0. This issue affects the function sys_thread_sigprocmask of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument how leads to improper validation of array index.
- Product
- Rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025A vulnerability classified as critical was found in RT-Thread 5.1.0.CVE-2025-5867 · Other software · Rt-thread · reported by VulDBHigh 8.6
A vulnerability classified as critical was found in RT-Thread 5.1.0. This vulnerability affects the function csys_sendto of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument to leads to null pointer dereference.
- Product
- Rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025A vulnerability classified as critical has been found in RT-Thread 5.1.0.CVE-2025-5866 · Other software · Rt-thread · reported by VulDBHigh 8.6
A vulnerability classified as critical has been found in RT-Thread 5.1.0. This affects the function sys_sigprocmask of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument how leads to improper validation of array index.
- Product
- Rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2025A vulnerability was found in RT-Thread 5.1.0.CVE-2025-5865 · Other software · Rt-thread · reported by VulDBHigh 8.6
A vulnerability was found in RT-Thread 5.1.0. It has been rated as critical. Affected by this issue is the function sys_select of the file rt-thread/components/lwp/lwp_syscall.c of the component Parameter Handler. The manipulation of the argument timeout leads to memory corruption. The vendor explains, that "[t]he timeout parameter should be checked to check if it can be accessed correctly in kernel mode and used temporarily in kernel memory."
- Product
- Rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2025A vulnerability classified as problematic was found in RT-Thread up to 5.1.0.CVE-2025-1115 · Other software · Rt-thread · reported by VulDBMedium 4.8
A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_close/sys_device_control/sys_device_find/sys_device_init/sys_device_open/sys_device_read/sys_device_register/sys_device_write/sys_event_delete/sys_event_recv/sys_event_send/sys_mb_delete/sys_mb_recv/sys_mb_send/sys_mb_send_wait/sys_mq_recv/sys_mq_send/sys_mq_urgent/sys_mutex_delete/sys_mutex_release/sys_mutex_take/sys_rt_timer_control/sys_rt_timer_delete/sys_rt_timer_start/sys_rt_timer_stop/sys_sem_delete/sys_sem_release/sys_sem_take/sys_shmat/sys_shmdt/sys_thread_create/sys_thread_delete/sys_thread_startup/sys_timer_delete/sys_timer_gettime/sys_timer_settime of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument arg[0] leads to information disclosure. An attack has to be approached locally.
- Product
- Rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2024A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2.CVE-2024-25395 · Other software · rtthread · reported by MITREHigh 8.8
A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2.
- Product
- rtthread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 26, 2024A buffer overflow occurs in utilities/ymodem/ry_sy.c in RT-Thread through 5.0.2 because of an incorrect sprintf call or a missing '\0' character.CVE-2024-25394 · Other software · rt-thread · reported by MITREMedium 4.3
A buffer overflow occurs in utilities/ymodem/ry_sy.c in RT-Thread through 5.0.2 because of an incorrect sprintf call or a missing '\0' character.
- Product
- rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 26, 2024A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2.CVE-2024-25393 · Other software · rt-thread · reported by MITRECritical 9.8
A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2.
- Product
- at_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 26, 2024An out-of-bounds access occurs in utilities/var_export/var_export.c in RT-Thread through 5.0.2.CVE-2024-25392 · Other software · utilities_project · reported by MITREMedium 5.9
An out-of-bounds access occurs in utilities/var_export/var_export.c in RT-Thread through 5.0.2.
- Product
- utilities
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 26, 2024A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2.CVE-2024-25391 · Other software · rt-thread · reported by MITREHigh 8.4
A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2.
- Product
- rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 26, 2024A heap buffer overflow occurs in finsh/msh_file.c and finsh/msh.c in RT-Thread through 5.0.2.CVE-2024-25390 · Other software · rt-thread · reported by MITREHigh 8.4
A heap buffer overflow occurs in finsh/msh_file.c and finsh/msh.c in RT-Thread through 5.0.2.
- Product
- rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 26, 2024RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;" in calc_random in drCVE-2024-25389 · Other software · rt-thread · reported by MITREHigh 7.5
RT-Thread through 5.0.2 generates random numbers with a weak algorithm of "seed = 214013L * seed + 2531011L; return (seed >> 16) & 0x7FFF;" in calc_random in drivers/misc/rt_random.c.
- Product
- rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 26, 2024drivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.CVE-2024-25388 · Other software · rt-thread · reported by MITREHigh 8.4
drivers/wlan/wlan_mgmt,c in RT-Thread through 5.0.2 has an integer signedness error and resultant buffer overflow.
- Product
- rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 26, 2024A heap buffer overflow occurs in the dfs_v2 romfs filesystem RT-Thread through 5.0.2.CVE-2024-24335 · Other software · rt-thread · reported by MITREHigh 8.4
A heap buffer overflow occurs in the dfs_v2 romfs filesystem RT-Thread through 5.0.2.
- Product
- rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Mar 26, 2024A heap buffer overflow occurs in dfs_v2 dfs_file in RT-Thread through 5.0.2.CVE-2024-24334 · Other software · rt-thread · reported by MITREHigh 8.4
A heap buffer overflow occurs in dfs_v2 dfs_file in RT-Thread through 5.0.2.
- Product
- rt-thread
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.