Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Feb 10, 2026Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolkits before version 2025.0.CVE-2025-20106 · Other software · reported by secure@intel.comMedium 5.4
Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolkits before version 2025.0. within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2025Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of privilege.CVE-2025-20056 · Other software · reported by secure@intel.comMedium 4.8
Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2025VTun-ng is a Virtual Tunnel over TCP/IP network.CVE-2025-54870 · Other software · leakingmemory · reported by GitHubHigh 8.7
VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due to insufficient error handling. The bug was first introduced in VTun-ng version 3.0.12. This is fixed in version 3.0.18. To workaround this issue, avoid blowfish-256.
- Product
- vtun-ng
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Improper Input validation in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable denial of sCVE-2024-37027 · Other software · Intel · reported by secure@intel.comMedium 5.2
Improper Input validation in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Oneapi Base Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable escaCVE-2024-36245 · Other software · intel · reported by secure@intel.comMedium 5.4
Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- vtune_profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2024Uncontrolled search path in some Intel(R) VTune(TM) Profiler software before versions 2024.1 may allow an authenticated user to potentially enable escalation ofCVE-2024-29015 · Other software · intel · reported by secure@intel.comMedium 5.4
Uncontrolled search path in some Intel(R) VTune(TM) Profiler software before versions 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- vtune_profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2024Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authenticated user to potentially enable escalaCVE-2023-45320 · Other software · intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- vtune_profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Uncontrolled search path element in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escalatCVE-2022-41982 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path element in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Vtune Profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Insecure inherited permissions in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escalatioCVE-2022-41658 · Other software · Intel · reported by secure@intel.comMedium 6.7
Insecure inherited permissions in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Vtune Profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation ofCVE-2022-26028 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Vtune Profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Uncontrolled search path elements in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escaCVE-2022-21807 · Other software · Intel · reported by secure@intel.comHigh 7.8
Uncontrolled search path elements in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Vtune Profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentialCVE-2021-33062 · Other software · Intel · reported by secure@intel.comHigh 7.8
Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Vtune Profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Insecure inherited permissions in the installer for the Intel(R) VTune(TM) Profiler before version 2021.1.1 may allow an authenticated user to potentially enablCVE-2021-0077 · Other software · Intel · reported by secure@intel.comHigh 7.8
Insecure inherited permissions in the installer for the Intel(R) VTune(TM) Profiler before version 2021.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Vtune Profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2020Uncontrolled search path in the Intel(R) VTune(TM) Profiler before version 2020 Update 1 may allow an authenticated user to potentially enable escalation of priCVE-2020-12329 · Other software · Intel · reported by secure@intel.comHigh 7.8
Uncontrolled search path in the Intel(R) VTune(TM) Profiler before version 2020 Update 1 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Vtune Profiler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2020Improper access control in driver for Intel(R) VTune(TM) Amplifier for Windows* before update 8 may allow an authenticated user to potentially enable escalationCVE-2019-14613 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper access control in driver for Intel(R) VTune(TM) Amplifier for Windows* before update 8 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Intel(R) VTune(TM) Amplifier for Windows*
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2018Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access CVE-2018-18093 · Other software · Intel Corporation · reported by secure@intel.comHigh 7.8
Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access via local access.
- Product
- Intel VTune Amplifier
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2017Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI LibrarCVE-2017-5682 · Other software · Intel · reported by secure@intel.comHigh 7.3
Intel PSET Application Install wrapper of Intel Parallel Studio XE, Intel System Studio, Intel VTune Amplifier, Intel Inspector, Intel Advisor, Intel MPI Library, Intel Trace Analyzer and Collector, Intel Integrated Performance Primitives, Cryptography for Intel Integrated Performance Primitives, Intel Math Kernel Library, Intel Data Analytics Acceleration Library, and Intel Threading Building Blocks before 2017 Update 2 allows an attacker to launch a process with escalated privileges.
- Product
- Advisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurity-center.intel.com
Dec 31, 2002Vtun 2.5b1 allows remote attackers to inject data into user sessions by sniffing and replaying packets.CVE-2002-1746 · Other software · Maxim Krasnyansky · reported by MITREMedium 5
Vtun 2.5b1 allows remote attackers to inject data into user sessions by sniffing and replaying packets.
- Product
- Vtun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgexchange.xforce.ibmcloud.com
Dec 31, 2002Vtun 2.5b1 does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the CVE-2002-1747 · Other software · Maxim Krasnyansky · reported by MITREMedium 5
Vtun 2.5b1 does not authenticate forwarded packets, which allows remote attackers to inject data into user sessions without detection, and possibly control the data contents via cut-and-paste attacks on ECB.
- Product
- Vtun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgexchange.xforce.ibmcloud.com
Dec 31, 2002Electronic Code Book (ECB) mode in VTun 2.0 through 2.5 uses a weak encryption algorithm that produces the same ciphertext from the same plaintext blocks, whichCVE-2002-1697 · Other software · Vtun Project · reported by MITREHigh 7.5
Electronic Code Book (ECB) mode in VTun 2.0 through 2.5 uses a weak encryption algorithm that produces the same ciphertext from the same plaintext blocks, which could allow remote attackers to gain sensitive information.
- Product
- Vtun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.