Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19 results
Apr 20, 2026Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32965 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpHigh 8.7
Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. When the affected device is connected to the network with the initial (factory-default) configuration, the device can be configured with the null string password.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32964 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpMedium 6.9
SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CRLF sequences ('CRLF Injection') vulnerability. Processing some crafted configuration data may lead to arbitrary entries injected to the system configuration.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32963 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpMedium 5.1
SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting vulnerability. When a user logs in to the affected device and access some crafted web page, arbitrary script may be executed on the user's browser.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32962 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpMedium 6.9
SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue. The device configuration may be altered without authentication.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32961 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpMedium 6.9
SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in packet data processing of sx_smpd. Processing a crafted packet may cause a temporary denial-of-service (DoS) condition.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32960 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpHigh 7.1
SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a sensitive information in resource not removed before reuse. An attacker may login to the device without knowing the password by sending a crafted packet.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32959 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpHigh 8.2
SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with a use of a broken or risky cryptographic algorithm. Information in the traffic may be retrieved via man-in-the-middle attack.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32958 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpMedium 6.9
SD-330AC and AMC Manager provided by silex technology, Inc. use a hard-coded cryptographic key. An administrative user may be directed to apply a fake firmware update.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32957 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpMedium 6.9
SD-330AC and AMC Manager provided by silex technology, Inc. contain a missing authentication for critical function issue on firmware maintenance. Arbitrary file may be uploaded on the device without authentication.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32956 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpCritical 9.3
SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code may be executed on the device.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026SD-330AC and AMC Manager provided by silex technology, Inc.CVE-2026-32955 · Other software · silex technology, Inc. · reported by vultures@jpcert.or.jpHigh 8.7
SD-330AC and AMC Manager provided by silex technology, Inc. contain a stack-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code may be executed on the device.
- Product
- SD-330AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2024An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packets using the EXEC REBCVE-2024-24487 · Other software · silex · reported by MITREMedium 6.8
An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to cause a denial of service via crafted UDP packets using the EXEC REBOOT SYSTEM command.
- Product
- ds-600_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comraw.githubusercontent.com
Apr 15, 2024An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit device settings via the SAVE EEP_DATA command.CVE-2024-24486 · Other software · silex · reported by MITRECritical 9.1
An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to edit device settings via the SAVE EEP_DATA command.
- Product
- ds-600_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comraw.githubusercontent.com
Apr 15, 2024An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information via the GET EEP_DATA command.CVE-2024-24485 · Other software · silex · reported by MITREHigh 7.5
An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information via the GET EEP_DATA command.
- Product
- ds-600_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2018Silex SD-320AN version 2.01 and prior and GE MobileLink(GEH-SD-320AN) version GEH-1.1 and prior have a system call parameter that is not properly sanitized, whiCVE-2018-6021 · Other software · Silextechnology · reported by MITREHigh 7.4
Silex SD-320AN version 2.01 and prior and GE MobileLink(GEH-SD-320AN) version GEH-1.1 and prior have a system call parameter that is not properly sanitized, which may allow remote code execution.
- Product
- Sd-320an Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
May 9, 2018In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may alloCVE-2018-6020 · Other software · Silextechnology · reported by MITREMedium 6.5
In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings.
- Product
- Sd-320an Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Jul 2, 2014silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via a crafted IP packet, a differenCVE-2014-3890 · Other software · Silex · reported by vultures@jpcert.or.jpMedium 5
silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via a crafted IP packet, a different vulnerability than CVE-2014-3889.
- Product
- Sx-2000wg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2014silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via crafted data in the Options fieCVE-2014-3889 · Other software · Silex · reported by vultures@jpcert.or.jpMedium 5
silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via crafted data in the Options field of a TCP header, a different vulnerability than CVE-2014-3890.
- Product
- Sx-2000wg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2014Cross-site scripting (XSS) vulnerability in Silex before 2.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2014-1971 · Other software · Silexlabs · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Silex before 2.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Silex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.