Updated 30 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

37added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

16 results

Mar 3, 2026Qualcomm Multiple Chipsets Memory Corruption VulnerabilityCVE-2026-21385 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8
Multiple Qualcomm chipsets contain a memory corruption vulnerability while using alignments for memory allocation.
Product
Multiple Chipsets
On CISA’s list since
Mar 3, 2026 (federal fix deadline Mar 24, 2026)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com source.android.com
Jun 3, 2025Qualcomm Multiple Chipsets Incorrect Authorization VulnerabilityCVE-2025-21479 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.6
Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Product
Multiple Chipsets
On CISA’s list since
Jun 3, 2025 (federal fix deadline Jun 24, 2025)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Jun 3, 2025Qualcomm Multiple Chipsets Incorrect Authorization VulnerabilityCVE-2025-21480 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.6
Multiple Qualcomm chipsets contain an incorrect authorization vulnerability. This vulnerability allows for memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Product
Multiple Chipsets
On CISA’s list since
Jun 3, 2025 (federal fix deadline Jun 24, 2025)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Jun 3, 2025Qualcomm Multiple Chipsets Use-After-Free VulnerabilityCVE-2025-27038 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.5
Multiple Qualcomm chipsets contain a use-after-free vulnerability. This vulnerability allows for memory corruption while rendering graphics using Adreno GPU drivers in Chrome.
Product
Multiple Chipsets
On CISA’s list since
Jun 3, 2025 (federal fix deadline Jun 24, 2025)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Mar 24, 2025reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityCVE-2025-30154 · Other software · reviewdog · reported by GitHubExploitedHigh 8.6
reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that dumps exposed secrets to Github Actions Workflow Logs.
Product
action-setup GitHub Action
On CISA’s list since
Mar 24, 2025 (federal fix deadline Apr 14, 2025)
What to do
Attackers are using this now. Install reviewdog’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Oct 8, 2024Qualcomm Multiple Chipsets Use-After-Free VulnerabilityCVE-2024-43047 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8
Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory.
Product
Multiple Chipsets
On CISA’s list since
Oct 8, 2024 (federal fix deadline Oct 29, 2024)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog docs.qualcomm.com cisa.gov
Jan 8, 2024Apache Superset Insecure Default Initialization of Resource VulnerabilityCVE-2023-27524 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.9
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
Product
Superset
On CISA’s list since
Jan 8, 2024 (federal fix deadline Jan 29, 2024)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.apache.org packetstormsecurity.com
Dec 5, 2023Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset VulnerabilityCVE-2023-33106 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.4
Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
Product
Multiple Chipsets
On CISA’s list since
Dec 5, 2023 (federal fix deadline Dec 26, 2023)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com
Dec 5, 2023Qualcomm Multiple Chipsets Integer Overflow VulnerabilityCVE-2023-33107 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.4
Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Product
Multiple Chipsets
On CISA’s list since
Dec 5, 2023 (federal fix deadline Dec 26, 2023)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com
Dec 5, 2023Qualcomm Multiple Chipsets Use-After-Free VulnerabilityCVE-2023-33063 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8
Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.
Product
Multiple Chipsets
On CISA’s list since
Dec 5, 2023 (federal fix deadline Dec 26, 2023)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com
Dec 5, 2023Qualcomm Multiple Chipsets Use-After-Free VulnerabilityCVE-2022-22071 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.4
Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.
Product
Multiple Chipsets
On CISA’s list since
Dec 5, 2023 (federal fix deadline Dec 26, 2023)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com
Oct 10, 2023HTTP/2 Rapid Reset Attack VulnerabilityCVE-2023-44487 · Other software · IETF · reported by MITREExploitedHigh 7.5
HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
Product
HTTP/2
On CISA’s list since
Oct 10, 2023 (federal fix deadline Oct 31, 2023)
What to do
Attackers are using this now. Install IETF’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Dec 1, 2021Qualcomm Multiple Chipsets Improper Input Validation VulnerabilityCVE-2020-11261 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
On CISA’s list since
Dec 1, 2021 (federal fix deadline Jun 1, 2022)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com
Nov 3, 2021Mediatek Multiple Chipsets Insufficient Input Validation VulnerabilityCVE-2020-0069 · Computers, phones & browsers · MediaTek · reported by security@android.comExploitedHigh 7.8
Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."
Product
Multiple Chipsets
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install MediaTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog huawei.com source.android.com
Nov 3, 2021Qualcomm Multiple Chipsets Detection of Error Condition Without Action VulnerabilityCVE-2021-1906 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedMedium 6.2
Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure.
Product
Multiple Chipsets
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com
Nov 3, 2021Qualcomm Multiple Chipsets Use-After-Free VulnerabilityCVE-2021-1905 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 8.4
Multiple Qualcomm Chipsets contain a use after free vulnerability due to improper handling of memory mapping of multiple processes simultaneously.
Product
Multiple Chipsets
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.