Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Oct 1, 2026An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileCVE-2026-104018 · Other software · Wind River Systems Inc · reported by 0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8High 8.8
An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the privilege check that is normally applied, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. Successful exploitation can result in privilege escalation, with impact to the confidentiality, integrity, and availability of the affected device. The issue affects all versions of VxWorks 7 prior to 26.09. It has been fixed in 26.09.
- Product
- VxWorks 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.com
Sep 28, 2026In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernCVE-2026-102006 · Other software · Wind River Systems Inc · reported by 0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8Medium 5.5
In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09
- Product
- VxWorks 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.com
Sep 28, 2026Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causiCVE-2026-102005 · Other software · Wind River Inc · reported by 0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8Medium 5.5
Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 26.09
- Product
- VxWorks 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.com
Sep 28, 2026Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem.CVE-2026-102004 · Other software · Wind River Systems Inc · reported by 0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8High 7.8
Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09
- Product
- VxWorks 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.com
Sep 28, 2026Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and syCVE-2026-97686 · Other software · Wind River · reported by 0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8Medium 5.5
Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the calling application. Fixed in Version 26.09.
- Product
- VxWorks 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.com
Sep 18, 2025A crafted system call argument can cause memory corruption.CVE-2025-26503 · Other software · Wind River Systems Inc · reported by 0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8Medium 6.7
A crafted system call argument can cause memory corruption.
- Product
- VxWorks 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.com
Mar 21, 2025: Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation.CVE-2025-26500 · Other software · Wind River Systems · reported by 0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8Medium 4.6
: Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation. Specifically crafted USB packets may lead to the system becoming unavailable This issue affects VxWorks 7: from 22.06 through 24.03.
- Product
- VxWorks 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.com
May 14, 2024A crafted network packet may cause a buffer overrun in Wind River VxWorks 7 through 23.09.CVE-2024-28759 · Other software · reported by MITREMedium 4.3
A crafted network packet may cause a buffer overrun in Wind River VxWorks 7 through 23.09.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.comwindriver.com
Feb 15, 2024An issue was discovered in Wind River VxWorks 7 22.09 and 23.03.CVE-2023-51787 · Other software · windriver · reported by MITREHigh 7.5
An issue was discovered in Wind River VxWorks 7 22.09 and 23.03. If a VxWorks task or POSIX thread that uses OpenSSL exits, limited per-task memory is not freed, resulting in a memory leak.
- Product
- vxworks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.comsupport2.windriver.com
May 12, 2021An issue was discovered in Wind River VxWorks 7.CVE-2020-35198 · Other software · Windriver · reported by MITRECritical 9.8
An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.
- Product
- Vxworks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.comsupport2.windriver.com
Apr 13, 2021An issue was discovered in Wind River VxWorks 7 before 21.03.CVE-2021-29997 · Other software · Windriver · reported by MITREMedium 5.3
An issue was discovered in Wind River VxWorks 7 before 21.03. A specially crafted packet may lead to buffer over-read on IKE.
- Product
- Vxworks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport2.windriver.comsupport2.windriver.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.