Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,602 results · page 3 of 53
May 4, 2026Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.CVE-2025-47406 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.1
Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Memory corruption when processing camera sensor input/output control codes with invalid output buffers.CVE-2025-47405 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption when processing camera sensor input/output control codes with invalid output buffers.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.CVE-2025-47404 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.CVE-2025-47403 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026Transient DOS when processing target power rate tables during channel configuration.CVE-2025-47401 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Transient DOS when processing target power rate tables during channel configuration.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when handling power management requests with improperly sized input/output buffers.CVE-2026-21382 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when handling power management requests with improperly sized input/output buffers.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.CVE-2026-21381 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.6
Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.CVE-2026-21380 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.CVE-2026-21378 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.CVE-2026-21376 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.CVE-2026-21375 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.CVE-2026-21374 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.CVE-2026-21373 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.CVE-2026-21372 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when retrieving output buffer with insufficient size validation.CVE-2026-21371 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when retrieving output buffer with insufficient size validation.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.CVE-2026-21367 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.6
Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Cryptographic issue while copying data to a destination buffer without validating its size.CVE-2025-47400 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.1
Cryptographic issue while copying data to a destination buffer without validating its size.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory corruption when decoding corrupted satellite data files with invalid signature offsets.CVE-2025-47392 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.8
Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory corruption while processing a frame request from user.CVE-2025-47391 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while processing a frame request from user.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory corruption while preprocessing IOCTL request in JPEG driver.CVE-2025-47390 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while preprocessing IOCTL request in JPEG driver.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.CVE-2025-47389 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling.CVE-2025-47374 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Memory Corruption when processing invalid user address with nonstandard buffer address.CVE-2025-59603 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when processing invalid user address with nonstandard buffer address.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Memory Corruption when adding user-supplied data without checking available buffer space.CVE-2025-59600 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when adding user-supplied data without checking available buffer space.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.CVE-2025-47386 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Memory Corruption when accessing trusted execution environment without proper privilege check.CVE-2025-47385 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when accessing trusted execution environment without proper privilege check.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Transient DOS when MAC configures config id greater than supported maximum value.CVE-2025-47384 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Transient DOS when MAC configures config id greater than supported maximum value.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.CVE-2025-47383 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.2
Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.CVE-2025-47381 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.CVE-2025-47379 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.CVE-2025-47378 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.1
Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.CVE-2025-47377 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.CVE-2025-47376 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Memory corruption while handling different IOCTL calls from the user-space simultaneously.CVE-2025-47375 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption while handling different IOCTL calls from the user-space simultaneously.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Memory Corruption when accessing buffers with invalid length during TA invocation.CVE-2025-47373 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when accessing buffers with invalid length during TA invocation.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Transient DOS when an LTE RLC packet with invalid TB is received by UE.CVE-2025-47371 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Transient DOS when an LTE RLC packet with invalid TB is received by UE.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026rldns is an open source DNS server.CVE-2026-27831 · Other software · bluedragonsecurity · reported by GitHubHigh 7.5
rldns is an open source DNS server. Version 1.3 has a heap-based out-of-bounds read that leads to denial of service. Version 1.4 contains a patch for the issue.
- Product
- rldns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Transient DOS when processing a received frame with an excessively large authentication information element.CVE-2025-47402 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Transient DOS when processing a received frame with an excessively large authentication information element.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.CVE-2025-47399 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.CVE-2025-47398 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.CVE-2025-47397 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.CVE-2025-47366 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.1
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Memory corruption while calculating offset from partition start point.CVE-2025-47364 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.8
Memory corruption while calculating offset from partition start point.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Memory corruption when calculating oversized partition sizes without proper checks.CVE-2025-47363 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.8
Memory corruption when calculating oversized partition sizes without proper checks.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Memory Corruption when multiple threads simultaneously access a memory free API.CVE-2025-47359 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when multiple threads simultaneously access a memory free API.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently.CVE-2025-47358 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026Dragonfly is an open source P2P-based file distribution and image acceleration system.CVE-2026-24124 · Other software · dragonflyoss · reported by GitHubHigh 8.9
Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below, the Job API endpoints (/api/v1/jobs) lack JWT authentication middleware and RBAC authorization checks in the routing configuration. This allows any unauthenticated user with access to the Manager API to view, update and delete jobs. The issue is fixed in version 2.4.1-rc.1.
- Product
- dragonfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026Redragon Gaming Mouse driver contains a kernel-level vulnerability that allows attackers to trigger a denial of service by sending malformed IOCTL requests.CVE-2021-47786 · Other software · Redragon · reported by VulnCheckMedium 6.8
Redragon Gaming Mouse driver contains a kernel-level vulnerability that allows attackers to trigger a denial of service by sending malformed IOCTL requests. Attackers can send a crafted 2000-byte buffer with specific byte patterns to the REDRAGON_MOUSE device to crash the kernel driver.
- Product
- Redragon Gaming Mouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 7, 2026Memory corruption occurs when a secure application is launched on a device with insufficient memory.CVE-2025-47396 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Memory corruption occurs when a secure application is launched on a device with insufficient memory.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.CVE-2025-47395 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.5
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.