Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
167 results · page 1 of 4
Sep 8, 2026MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol.CVE-2026-53937 · Other software · modelcontextprotocol · reported by GitHubMedium 6.2
MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt` writes every chunk of bytes received from the stdio transport into a `kotlinx.io.Buffer` with no size cap. Frames are extracted from that buffer only when a `\n` (0x0a) byte is observed. A peer that streams bytes without ever sending a newline causes the internal buffer to grow indefinitely until the JVM (or the surrounding host process) is OOM-killed. The leak is amplified by `StdioServerTransport` and `StdioClientTransport`, which both queue raw chunks through a `kotlinx.coroutines.channels.Channel<ByteArray>(Channel.UNLIMITED)` and then call `readBuffer.append(chunk)` without backpressure or size guard. This is a remote-pre-auth denial of service whenever an SDK stdio server's stdin is fed by an untrusted or attacker-controlled producer (for example: a host program that exec's the MCP server as a subprocess and pipes through bytes received from a network peer, or a sidecar wrapper that proxies bytes from an HTTP endpoint to the st
- Product
- io.modelcontextprotocol:kotlin-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service.CVE-2026-34620 · Other software · Adobe · reported by AdobeMedium 5.5
DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to corrupt memory, causing the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure.CVE-2026-34616 · Other software · Adobe · reported by AdobeMedium 5.5
DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2026DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contextCVE-2026-48389 · Other software · Adobe · reported by AdobeHigh 7.8
DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service.CVE-2026-48267 · Other software · Adobe · reported by AdobeMedium 5.5
DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context CVE-2026-47964 · Other software · Adobe · reported by AdobeHigh 7.8
DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2026-47963 · Other software · Adobe · reported by AdobeMedium 5.5
DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2026-47934 · Other software · Adobe · reported by AdobeMedium 5.5
DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory.CVE-2026-47927 · Other software · Adobe · reported by AdobeMedium 5.5
DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026DNG SDK versions 1.7.1 2471 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service.CVE-2026-27281 · Other software · Adobe · reported by AdobeMedium 5.5
DNG SDK versions 1.7.1 2471 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026DNG SDK versions 1.7.1 2471 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of theCVE-2026-27280 · Other software · Adobe · reported by AdobeHigh 7.8
DNG SDK versions 1.7.1 2471 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026The Dart and Flutter SDKs provide software development kits for the Dart programming language.CVE-2026-27704 · Other software · dart-lang · reported by GitHubMedium 6.6
The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the `PUB_CACHE`. A fix has been landed in commit 26c6985c742593d081f8b58450f463a584a4203a. By normalizing the file path before writing file, the attacker can no longer traverse up via a symlink. This patch is released in Dart 3.11.0 and Flutter 3.41.0.vAll packages on pub.dev have been vetted for this vulnerability. New packages are no longer allowed to contain symlinks. The pub client itself doesn't upload symlinks, but duplicates the linked entry, and has been doing this for years. Those whose dependencies are all from pub.dev, third-party repositories trusted to not contain malicious code, or git dependencies are not affected by this vulnerability.
- Product
- sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure.CVE-2026-21355 · Other software · Adobe · reported by AdobeMedium 5.5
DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service.CVE-2026-21354 · Other software · Adobe · reported by AdobeMedium 5.5
DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the conCVE-2026-21353 · Other software · Adobe · reported by AdobeHigh 7.8
DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of theCVE-2026-21352 · Other software · Adobe · reported by AdobeHigh 7.8
DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe DNG Software Development Kit (SDK)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025dstack is a software development kit (SDK) to simplify the deployment of arbitrary containerized apps into trusted execution environments.CVE-2025-59054 · Other software · Dstack-TEE · reported by GitHubHigh 8.5
dstack is a software development kit (SDK) to simplify the deployment of arbitrary containerized apps into trusted execution environments. In versions of dstack prior to 0.5.4, a malicious host may provide a crafted LUKS2 data volume to a dstack CVM for use as the `/data` mount. The guest will open the volume and write secret data using a volume key known to the attacker, causing disclosure of Wireguard keys and other secret information. The attacker can also pre-load data on the device, which could potentially compromise guest execution. LUKS2 volume metadata is not authenticated and supports null key-encryption algorithms, allowing an attacker to create a volume such that the volume opens (cryptsetup open) without error using any passphrase or token, records all writes in plaintext (or ciphertext with an attacker-known key), and/or contains arbitrary data chosen by the attacker. Version 0.5.4 of dstack contains a patch that addresses LUKS headers.
- Product
- dstack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2025Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data paCVE-2025-44526 · Network & remote access · Realtek · reported by MITREMedium 6.5
Realtek RTL8762EKF-EVB RTL8762E SDK V1.4.0 was discovered to utilize insufficient permission checks on critical fields within Bluetooth Low Energy (BLE) data packets. This issue allows attackers to cause a Denial of Service (DoS) via a crafted LL_Length_Req packet.
- Product
- Rtl8762e Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2025An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pairing public key is CVE-2025-44531 · Network & remote access · Realtek · reported by MITREHigh 7.5
An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pairing public key is received during a Bluetooth connection attempt.
- Product
- Rtl8762e Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component.CVE-2024-24292 · Other software · Aliconnect · reported by MITRECritical 9.8
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function in the aim.js component.
- Product
- Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jan 21, 2025Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Software Development Kit).CVE-2025-21560 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: SDK-Software Development Kit). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- Oracle Agile PLM Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.CVE-2024-50931 · Other software · Silabs · reported by MITREMedium 4.6
Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions.
- Product
- Z-wave Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.CVE-2024-50930 · Other software · Silabs · reported by MITREHigh 8.8
An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code.
- Product
- Z-wave Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memoryCVE-2024-50929 · Other software · Silabs · reported by MITREMedium 6.2
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service (DoS).
- Product
- Z-wave Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memorCVE-2024-50928 · Other software · Silabs · reported by MITREMedium 6.5
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memory, disrupting the device's communications with the controller.
- Product
- Z-wave Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the dCVE-2024-50924 · Other software · Silabs · reported by MITREMedium 6.5
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending crafted packets to the controller.
- Product
- Z-wave Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending crafteCVE-2024-50921 · Other software · Silabs · reported by MITREMedium 6.5
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending crafted packets to the controller.
- Product
- Z-wave Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2024Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets.CVE-2024-50920 · Other software · Silabs · reported by MITREHigh 8.8
Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets.
- Product
- Z-wave Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page.CVE-2024-47824 · Other software · matrix-org · reported by GitHubHigh 8.7
matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0, matrix-react-sdk allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite. Version 3.102.0 fixes this issue by disabling sharing message keys on invite by removing calls to the vulnerable functionality. No known workarounds are available.
- Product
- matrix-react-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2023AWS SDK for PHP is the Amazon Web Services software development kit for PHP.CVE-2023-51651 · Other software · aws · reported by GitHubMedium 6
AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.
- Product
- aws-sdk-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2023lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c.CVE-2023-39743 · Other software · Pete4abw · reported by MITREMedium 5.3
lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c.
- Product
- Lzma Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 10, 2023Incorrect default permissions in some Intel(R) RealSense(TM) SDKs in version 2.53.1 may allow an authenticated user to potentially enable escalation of privilegCVE-2023-32663 · Other software · Intel · reported by secure@intel.comMedium 6.7
Incorrect default permissions in some Intel(R) RealSense(TM) SDKs in version 2.53.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Realsense Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023Uncontrolled search path element in some Intel(R) PSR SDK before version 1.0.0.20 may allow an authenticated user to potentially enable escalation of privilege CVE-2023-29151 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path element in some Intel(R) PSR SDK before version 1.0.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Platform Service Record Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may leadCVE-2023-27911 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution.
- Product
- FBX Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Apr 17, 2023A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may leaCVE-2023-27910 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or prior which may lead to code execution.
- Product
- FBX Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Apr 17, 2023An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through maliciously crafted FBX files or informationCVE-2023-27909 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through maliciously crafted FBX files or information disclosure.
- Product
- FBX Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Feb 16, 2023Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service viCVE-2022-36289 · Other software · Intel · reported by secure@intel.comLow 2.8
Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Media Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via loCVE-2022-35883 · Other software · Intel · reported by secure@intel.comLow 2.2
NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Media Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Improper buffer restrictions in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilCVE-2022-34841 · Other software · Intel · reported by secure@intel.comMedium 5.7
Improper buffer restrictions in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Media Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Out-of-bounds read in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via loCVE-2022-34346 · Other software · Intel · reported by secure@intel.comMedium 4.8
Out-of-bounds read in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Media Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilCVE-2022-27170 · Other software · Intel · reported by secure@intel.comMedium 5.7
Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Media Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro and Standard Edition software may allow an authenticated user to potentially enable escalation ofCVE-2022-37329 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro and Standard Edition software may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Fpga Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Improper access control in the Intel(R) FPGA SDK for OpenCL(TM) with Intel(R) Quartus(R) Prime Pro Edition software before version 22.1 may allow authenticated CVE-2022-34157 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper access control in the Intel(R) FPGA SDK for OpenCL(TM) with Intel(R) Quartus(R) Prime Pro Edition software before version 22.1 may allow authenticated user to potentially enable escalation of privilege via local access.
- Product
- Fpga Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow.CVE-2022-31364 · Other software · Infineon · reported by MITREHigh 8.2
Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is lower_transport_layer_on_seg. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered by sending a series of segmented packets with inconsistent SegN.
- Product
- Cypress Bluetooth Mesh Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Feb 1, 2023Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow.CVE-2022-31363 · Other software · Infineon · reported by MITREHigh 8.2
Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is pb_transport_handle_frag_. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered during mesh provisioning. Because there is no check for mismatched SegN and TotalLength in Transaction Start PDU.
- Product
- Cypress Bluetooth Mesh Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Feb 1, 2023In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no check for the SegN fiCVE-2022-30904 · Other software · Bestechnic · reported by MITREHigh 8.2
In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no check for the SegN field of the Transaction Start PDU.
- Product
- Bluetooth Mesh Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comdocs.google.com
Dec 27, 2022A vulnerability was found in AWS SDK 2.59.0.CVE-2022-4725 · Other software · Amazon · reported by VulDBMedium 5.5
A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.
- Product
- AWS Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R) MC before version 2CVE-2022-26341 · Other software · Intel · reported by secure@intel.comHigh 8.2
Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R) MC before version 2.3.2 may allow an authenticated user to potentially enable escalation of privilege via network access.
- Product
- Active Management Technology Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022An Out-Of-Bounds Write Vulnerability in Autodesk FBX SDK 2020 version and prior may lead to code execution through maliciously crafted FBX files or information CVE-2022-41304 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
An Out-Of-Bounds Write Vulnerability in Autodesk FBX SDK 2020 version and prior may lead to code execution through maliciously crafted FBX files or information disclosure.
- Product
- FBX Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Oct 14, 2022A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in Autodesk FBX SDK 2020 version causing the applicatioCVE-2022-41303 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in Autodesk FBX SDK 2020 version causing the application to reference a memory location controlled by an unauthorized third party, thereby running arbitrary code on the system.
- Product
- FBX Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.