Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

587new WordPress flaws this week

391,288entries in the database

1,068 results · page 15 of 22

May 26, 2023The hwPartsDFR module has a vulnerability in API calling verification.CVE-2023-31227 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The hwPartsDFR module has a vulnerability in API calling verification. Successful exploitation of this vulnerability may affect device confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The SDK for the MediaPlaybackController module has improper permission verification.CVE-2023-31226 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The SDK for the MediaPlaybackController module has improper permission verification. Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The Gallery app has the risk of hijacking attacks.CVE-2023-31225 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
The Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download failures and affect product availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The online authentication provided by the hwKitAssistant lacks strict identity verification of applications.CVE-2023-0117 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this vulnerability may affect availability of features,such as MeeTime.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The reminder module lacks an authentication mechanism for broadcasts received.CVE-2023-0116 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The facial recognition TA of some products has the out-of-bounds memory read vulnerability.CVE-2022-48479 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The facial recognition TA of some products has the out-of-bounds memory read vulnerability. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record device.harmonyos.com device.harmonyos.com
May 26, 2023The facial recognition TA of some products lacks memory length verification.CVE-2022-48478 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The facial recognition TA of some products lacks memory length verification. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record device.harmonyos.com device.harmonyos.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46886 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46885 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46884 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46883 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46882 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46881 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 20, 2023The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability.CVE-2023-1696 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
May 20, 2023The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.CVE-2023-1694 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
May 20, 2023The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.CVE-2023-1693 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The Settings module has the file privilege escalation vulnerability.Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
May 20, 2023The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality.CVE-2023-1692 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The window management module lacks permission verification.Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Apr 16, 2023The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process.CVE-2022-48314 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Apr 16, 2023The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process.CVE-2022-48313 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Apr 16, 2023The HwPCAssistant module has the out-of-bounds read/write vulnerability.CVE-2022-48312 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The SystemUI module has a vulnerability of repeated app restart due to improper parameters.CVE-2023-26549 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The SystemUI module has a vulnerability of repeated app restart due to improper parameters. Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The pgmng module has a vulnerability in serialization/deserialization.CVE-2023-26548 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The pgmng module has a vulnerability in serialization/deserialization. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The InputMethod module has a vulnerability of serialization/deserialization mismatch.CVE-2023-26547 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The Always On Display (AOD) has a path traversal vulnerability in theme files.CVE-2022-48361 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
The Always On Display (AOD) has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a failure in reading AOD theme resources.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The facial recognition module has a vulnerability in file permission control.CVE-2022-48360 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The recovery mode for updates has a vulnerability that causes arbitrary disk modification.CVE-2022-48359 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The BatteryHealthActivity has a redirection vulnerability.CVE-2022-48358 · Other software · Huawei · reported by psirt@huawei.comHigh 7.4
The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023Some products have the double fetch vulnerability.CVE-2022-48357 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The facial recognition module has a vulnerability in input parameter verification.CVE-2022-48356 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recognition.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The Bluetooth module has a heap out-of-bounds read vulnerability.CVE-2022-48355 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
The Bluetooth module has a heap out-of-bounds read vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The Bluetooth module has a heap out-of-bounds write vulnerability.CVE-2022-48354 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
The Bluetooth module has a heap out-of-bounds write vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023Some smartphones have configuration issues.CVE-2022-48353 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system service exceptions.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023Some smartphones have data initialization issues.CVE-2022-48352 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Some smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The secure OS module has configuration defects.CVE-2022-48351 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The HUAWEI Messaging app has a vulnerability of unauthorized file access.CVE-2022-48350 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The control component has a spoofing vulnerability.CVE-2022-48349 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidentiality and availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The MediaProvider module has a vulnerability of unauthorized data read.CVE-2022-48348 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The MediaProvider module has a vulnerability in permission verification.CVE-2022-48347 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The HwContacts module has a logic bypass vulnerability.CVE-2022-48346 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023The Bluetooth module has an authentication bypass vulnerability in the pairing process.CVE-2022-48291 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
The Bluetooth module has an authentication bypass vulnerability in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 9, 2023The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data confidentiality.CVE-2022-48302 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 9, 2023The bundle management module lacks permission verification in some APIs.CVE-2022-48301 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The bundle management module lacks permission verification in some APIs. Successful exploitation of this vulnerability may restore the pre-installed apps that have been uninstalled.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 9, 2023The WMS module lacks the authentication mechanism in some APIs.CVE-2022-48300 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 9, 2023The WMS module lacks the authentication mechanism in some APIs.CVE-2022-48299 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The WMS module lacks the authentication mechanism in some APIs. Successful exploitation of this vulnerability may affect data confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 9, 2023The geofencing kernel code does not verify the length of the input data.CVE-2022-48298 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The geofencing kernel code does not verify the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 9, 2023The geofencing kernel code has a vulnerability of not verifying the length of the input data.CVE-2022-48297 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The geofencing kernel code has a vulnerability of not verifying the length of the input data. Successful exploitation of this vulnerability may cause out-of-bounds memory access.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 9, 2023The SystemUI has a vulnerability in permission management.CVE-2022-48296 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
The SystemUI has a vulnerability in permission management. Successful exploitation of this vulnerability may cause users to receive broadcasts from malicious apps, conveying false alarm information about external storage devices.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 9, 2023The IHwAntiMalPlugin interface lacks permission verification.CVE-2022-48295 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The IHwAntiMalPlugin interface lacks permission verification. Successful exploitation of this vulnerability can lead to filling problems (batch installation of applications).
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 9, 2023The IHwAttestationService interface has a defect in authentication.CVE-2022-48294 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The IHwAttestationService interface has a defect in authentication. Successful exploitation of this vulnerability may affect data confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 9, 2023The Bluetooth module has an OOM vulnerability.CVE-2022-48293 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
The Bluetooth module has an OOM vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.