Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
33 results
Sep 24, 2026Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.CVE-2026-58008 · Other software · Altera · reported by 04c0172e-9735-4a9d-a92a-fe01fa863447High 8.3
Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- Product
- Trusted Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.CVE-2026-58007 · Other software · Altera · reported by 04c0172e-9735-4a9d-a92a-fe01fa863447High 8.3
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- Product
- Trusted Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.CVE-2026-58006 · Other software · Altera · reported by 04c0172e-9735-4a9d-a92a-fe01fa863447High 8.3
Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- Product
- Trusted Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.CVE-2026-58005 · Other software · Altera · reported by 04c0172e-9735-4a9d-a92a-fe01fa863447High 8.3
Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- Product
- Trusted Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.CVE-2026-58004 · Other software · Altera · reported by 04c0172e-9735-4a9d-a92a-fe01fa863447High 8.3
Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- Product
- Trusted Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.CVE-2026-13467 · Other software · Altera · reported by 04c0172e-9735-4a9d-a92a-fe01fa863447High 8.3
Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- Product
- Trusted Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers.CVE-2026-13466 · Other software · Altera · reported by 04c0172e-9735-4a9d-a92a-fe01fa863447High 8.3
Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- Product
- Trusted Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.CVE-2026-13465 · Other software · Altera · reported by 04c0172e-9735-4a9d-a92a-fe01fa863447High 8.3
Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections. This issue affects Trusted Firmware: through socfpga_v2.14.0.
- Product
- Trusted Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplieCVE-2026-54467 · Other software · TrustedFirmware · reported by MITREHigh 7
On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.
- Product
- Trusted Firmware-M
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordreview.trustedfirmware.orgtrustedfirmware.org
Nov 23, 2025The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands wCVE-2025-54515 · Other software · AMD · reported by psirt@amd.comLow 1
The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands were incorrectly set to secure instead of using the processor’s actual security state. This would allow the PSCI requests to appear they were from processors in the secure state instead of the non-secure state.
- Product
- Versal™ Adaptive SoC Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2025The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memoriesCVE-2025-48507 · Other software · AMD · reported by psirt@amd.comHigh 8.6
The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memories, access to crypto operations, and the ability to turn on and off subsystems within the SOC.
- Product
- Kria™ SOM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade.CVE-2025-53022 · Other software · reported by MITREHigh 8.6
TrustedFirmware-M (aka Trusted Firmware for M profile Arm CPUs) before 2.1.3 and 2.2.x before 2.2.1 lacks length validation during a firmware upgrade. While processing a new image, the Firmware Upgrade (FWU) module does not validate the length field of the Type-Length-Value (TLV) structure for dependent components against the maximum allowed size. If the length specified in the TLV exceeds the size of the buffer allocated on the stack, the FWU module will overwrite the buffer (and potentially other stack data) with the TLV's value content. An attacker could exploit this by crafting a malicious TLV entry in the unprotected section of the MCUBoot upgrade image. By setting the length field to exceed the expected structure size, the attacker can manipulate the stack memory of the system during the upgrade process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.trustedfirmware.orgtrustedfirmware-m.readthedocs.io
Oct 9, 2024An issue was discovered in Trusted Firmware-M through 2.1.0.CVE-2024-45746 · Other software · trustedfirmware · reported by MITRECritical 9.8
An issue was discovered in Trusted Firmware-M through 2.1.0. User provided (and controlled) mailbox messages contain a pointer to a list of input arguments (in_vec) and output arguments (out_vec). These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length field. After a PSA call, the length of the output arguments behind the unchecked pointer is updated in mailbox_direct_reply, regardless of the call result. This allows an attacker to write anywhere in the secure firmware, which can be used to take over the control flow, leading to remote code execution (RCE).
- Product
- trusted_firmware-m
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrustedfirmware-m.readthedocs.iotrustedfirmware.org
Sep 5, 2024An issue was discovered in Trusted Firmware-M through 2.0.0.CVE-2023-51712 · Other software · Trustedfirmware · reported by MITREMedium 4.7
An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data via the login function.
- Product
- Trusted Firmware-m
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.trustedfirmware.orgtrustedfirmware-m.readthedocs.io
Sep 3, 2024Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may affect service confidCVE-2024-45448 · Other software · Huawei · reported by psirt@huawei.comMedium 4.1
Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 13, 2024Improper input validation in ARM® Trusted Firmware used in AMD’s Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged attacker to perform out of bound reads, CVE-2023-31339 · Other software · AMD · reported by psirt@amd.comMedium 4.8
Improper input validation in ARM® Trusted Firmware used in AMD’s Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged attacker to perform out of bound reads, potentially resulting in data leakage and denial of service.
- Product
- Zynq™ UltraScale+™ MPSoC/RFSoC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service.CVE-2023-49100 · Other software · reported by MITREMedium 4.4
Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdei_interrupt_bind. The parameter is passed to a call to plat_ic_get_interrupt_type. It can be any arbitrary value passing checks in the function plat_ic_is_sgi. A compromised Normal World (Linux kernel) can enable a root-privileged attacker to issue arbitrary SMC calls. Using this primitive, he can control the content of registers x0 through x6, which are used to send parameters to TF-A. Out-of-bounds addresses can be read in the context of TF-A (EL3). Because the read value is never returned to non-secure memory or in registers, no leak is possible. An attacker can still crash TF-A, however.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023 A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware.CVE-2023-5630 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.5
A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware.
- Product
- Trio Q-Series Ethernet Data Radio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Sep 7, 2023In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selectedCVE-2023-40271 · Other software · Trustedfirmware · reported by MITREHigh 7.5
In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the Authenticated Encryption with Associated Data Chacha20-Poly1305 algorithm is used, with the single-part verification function (defined during the build-time configuration phase) implemented with a dedicated function (i.e., not relying on usage of multipart functions), the buffer comparison during the verification of the authentication tag does not happen on the full 16 bytes but just on the first 4 bytes, thus leading to the possibility that unauthenticated payloads might be identified as authentic. This affects TF-Mv1.6.0, TF-Mv1.6.1, TF-Mv1.7.0, and TF-Mv1.8.
- Product
- Trusted Firmware-m
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.trustedfirmware.orgtf-m-user-guide.trustedfirmware.org
Jan 16, 2023Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates.CVE-2022-47630 · Other software · Trustedfirmware · reported by MITREHigh 7.4
Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.
- Product
- Trusted Firmware-a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comtrustedfirmware-a.readthedocs.io
Mar 1, 2022Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition.CVE-2021-43619 · Other software · Trustedfirmware · reported by MITREHigh 7.8
Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations.
- Product
- Trusted Firmware-m
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comgit.trustedfirmware.org
Jan 13, 2022Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control.CVE-2021-40327 · Other software · Trustedfirmware · reported by MITREMedium 5.9
Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto service) based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner.
- Product
- Trusted Firmware-m
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comgit.trustedfirmware.org
Dec 7, 2021An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0.CVE-2021-44149 · Other software · Trustedfirmware · reported by MITREHigh 7.8
An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write operations on Secure World memory. This involves a v cycle.
- Product
- Op-tee
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2021In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain informatioCVE-2021-24119 · Computers, phones & browsers · ARM · reported by MITREMedium 4.9
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
- Product
- Mbed TLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2021Arm Trusted Firmware Out-of-Bounds Write VulnerabilityCVE-2021-27562 · Computers, phones & browsers · Arm · reported by MITREExploitedMedium 5.5
Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure (NS) world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment (NSPE) handler mode. This vulnerability affects Yealink Device Management servers.
- Product
- Trusted Firmware
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline Nov 17, 2021)
- What to do
- Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdeveloper.arm.comgit.trustedfirmware.org
May 21, 2021In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) can prevent the abortCVE-2021-32032 · Other software · Trustedfirmware · reported by MITREHigh 7.5
In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) can prevent the abort() operation in the associated cryptographic library from freeing internal resources, causing a memory leak.
- Product
- Trusted Firmware-m
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.trustedfirmware.orggit.trustedfirmware.org
Sep 2, 2020A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret CVE-2020-16150 · Computers, phones & browsers · ARM · reported by MITREMedium 5.5
A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length.
- Product
- Mbed TLS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Jan 30, 2019ARM Trusted Firmware-A allows information disclosure.CVE-2018-19440 · Other software · Trustedfirmware · reported by MITREMedium 5.3
ARM Trusted Firmware-A allows information disclosure.
- Product
- Trusted Firmware-a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2018In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure world timing informCVE-2017-15031 · Other software · Trustedfirmware · reported by MITREHigh 7.5
In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure world timing information.
- Product
- Trusted Firmware-a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Sep 20, 2017The BL1 FWU SMC handling code in ARM Trusted Firmware before 1.4 might allow attackers to write arbitrary data to secure memory, bypass the bl1_plat_mem_check pCVE-2017-9607 · Other software · Trustedfirmware · reported by MITREHigh 7
The BL1 FWU SMC handling code in ARM Trusted Firmware before 1.4 might allow attackers to write arbitrary data to secure memory, bypass the bl1_plat_mem_check protection mechanism, cause a denial of service, or possibly have unspecified other impact via a crafted AArch32 image, which triggers an integer overflow.
- Product
- Trusted Firmware-a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2017In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service (secure world paCVE-2017-7564 · Other software · Trustedfirmware · reported by MITREHigh 7.5
In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service (secure world panic) via vectors involving debug exceptions and debug registers.
- Product
- Trusted Firmware-a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2017In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism.CVE-2017-7563 · Other software · Trustedfirmware · reported by MITREHigh 8.1
In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MT_EXECUTE_NEVER protection mechanism. This issue occurs because of inconsistency in the number of execute-never bits (one bit versus two bits).
- Product
- Trusted Firmware-a
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2017In ARM Trusted Firmware 1.2 and 1.3, a malformed firmware update SMC can result in copying unexpectedly large data into secure memory because of integer overfloCVE-2016-10319 · Computers, phones & browsers · ARM Trusted Firmware Project · reported by MITREMedium 5.9
In ARM Trusted Firmware 1.2 and 1.3, a malformed firmware update SMC can result in copying unexpectedly large data into secure memory because of integer overflows. This affects certain cases involving execution of both AArch64 Generic Trusted Firmware (TF) BL1 code and other firmware update code.
- Product
- ARM Trusted Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.