Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
32 results
Oct 14, 2026MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install aCVE-2026-110633 · Other software · Report One · reported by VulnCheckHigh 8.5
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.
- Product
- MyReport Updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.quarkslab.commyreport.fr
Oct 14, 2026Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater bCVE-2026-110632 · Other software · Report One · reported by VulnCheckCritical 9.2
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
- Product
- MyReport Updater
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.quarkslab.commyreport.fr
Oct 6, 2026Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability.CVE-2026-86362 · Other software · Dell · reported by security_alert@emc.comHigh 8.2
Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability.CVE-2026-86361 · Other software · Dell · reported by security_alert@emc.comHigh 8.2
Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability.CVE-2026-86360 · Other software · Dell · reported by security_alert@emc.comCritical 9.6
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system. Dell recommends customers upgrade at the earliest opportunity.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability.CVE-2026-71168 · Other software · Dell · reported by security_alert@emc.comHigh 7.3
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability.CVE-2026-63697 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with CVE-2026-6387 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.3
A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 8, 2023An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privCVE-2023-4632 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.8
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges.
- Product
- Lenovo System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
May 1, 2023A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.CVE-2022-4568 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7
A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.
- Product
- Lenovo System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Feb 10, 2023 Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module.CVE-2022-34404 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module. A local attacker with high privileges could potentially exploit this vulnerability, leading to credential theft and/or denial of service.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2022A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privCVE-2022-0354 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.3
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.cominfosec.tirol
Mar 10, 2022There is a man-in-the-middle attack vulnerability during system update download in recovery mode.CVE-2021-40055 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9
There is a man-in-the-middle attack vulnerability during system update download in recovery mode. Successful exploitation of this vulnerability may affect integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 24, 2022Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability.CVE-2022-22554 · Other software · Dell · reported by security_alert@emc.comHigh 8.2
Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability. A local attacker with user privleges could potentially exploit this vulnerability leading to the disclosure of user passwords.
- Product
- DellEMC System Update - DSU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2021Dell System Update (DSU) 1.9 and earlier versions contain a denial of service vulnerability.CVE-2021-21529 · Other software · Dell · reported by security_alert@emc.comLow 3.8
Dell System Update (DSU) 1.9 and earlier versions contain a denial of service vulnerability. A local authenticated malicious user with low privileges may potentially exploit this vulnerability to cause the system to run out of memory by running multiple instances of the vulnerable application.
- Product
- DellEMC System Update - DSU
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2020A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRFCVE-2020-8465 · Other software · Trend Micro · reported by security@trendmicro.comCritical 9.8
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRF bypass (CVE-2020-8461) and authentication bypass (CVE-2020-8464) to execute code as user root.
- Product
- Trend Micro InterScan Web Security Virtual Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.comsuccess.trendmicro.com
Sep 15, 2020A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege.CVE-2020-8342 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.3
A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Mar 27, 2020MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.CVE-2015-7336 · Other software · Lenovo · reported by MITREHigh 7.5
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow the signature check of an update to be bypassed.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Mar 27, 2020MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.CVE-2015-7335 · Other software · Lenovo · reported by MITREHigh 7
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow a user to execute arbitrary code with elevated privileges.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Mar 27, 2020MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.CVE-2015-7334 · Other software · Lenovo · reported by MITREHigh 7.8
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type COMMAND type could allow a user to execute arbitrary code with elevated privileges.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Mar 27, 2020MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.CVE-2015-7333 · Other software · Lenovo · reported by MITREHigh 7.8
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type INF and INF_BY_COMPATIBLE_ID command types could allow a user to execute arbitrary code with elevated privileges.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Sep 26, 2019A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to be written to non-staCVE-2019-6175 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.5
A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to be written to non-standard locations.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jun 26, 2019A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standardCVE-2019-6163 · Other software · Lenovo · reported by psirt@lenovo.comMedium 5.5
A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standard locations.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
May 4, 2018MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attackCVE-2018-9063 · Other software · Lenovo Group Ltd. · reported by psirt@lenovo.comHigh 7.8
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or password can overrun the program's buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv.
- Product
- Lenovo System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsupport.lenovo.com
Oct 2, 2017Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) aCVE-2015-6971 · Other software · Lenovo · reported by MITREHigh 7.8
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) and gain privileges by launching signed Lenovo executables.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comtrustwave.com
Apr 24, 2017Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by navigating to (1) "Click here to learn moreCVE-2015-8110 · Other software · Lenovo · reported by MITREHigh 7.8
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by navigating to (1) "Click here to learn more" or (2) "View privacy policy" within the Tvsukernel.exe GUI application in the context of a temporary administrator account, aka a "local privilege escalation vulnerability."
- Product
- Lenovo System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comioactive.com
Apr 24, 2017Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by making a prediction of tvsu_tmp_xxxxxXXXXX CVE-2015-8109 · Other software · Lenovo · reported by MITREHigh 7
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by making a prediction of tvsu_tmp_xxxxxXXXXX account credentials that requires knowledge of the time that this account was created, aka a "temporary administrator account vulnerability."
- Product
- Lenovo System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comioactive.com
Apr 10, 2017Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.CVE-2016-8237 · Other software · Lenovo Group Ltd. · reported by psirt@lenovo.comHigh 8.1
Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.
- Product
- Lenovo Updates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsupport.lenovo.com
May 12, 2015Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, whCVE-2015-2234 · Other software · Lenovo · reported by MITREMedium 6.9
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsupport.lenovo.com
May 12, 2015Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-iCVE-2015-2233 · Other software · Lenovo · reported by MITREHigh 8.3
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsupport.lenovo.com
May 12, 2015Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by senCVE-2015-2219 · Other software · Lenovo · reported by MITREHigh 7.2
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsupport.lenovo.com
Jul 21, 2008The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to CVE-2008-3249 · Other software · Lenovo · reported by MITREMedium 5.1
The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to install arbitrary packages via an SSL certificate whose X.509 headers match a public certificate used by IBM.
- Product
- Thinkvantage System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.