Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Nov 5, 2025Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability.CVE-2025-46424 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability. A high privileged attacker could potentially exploit this vulnerability leading to Denial of service.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the datCVE-2025-46366 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the database to obtain confidential information.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection oCVE-2025-46365 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell CloudLink, versions prior 8.1.1, contain a Command Injection vulnerability which can be exploited by an Authenticated attacker to cause Command Injection on an affected Dell CloudLink.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control ofCVE-2025-46364 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user with known password can run CLI Escape Vulnerability to gain control of system.
- Product
- CloudLin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell CVE-2025-45379 · Other software · Dell · reported by security_alert@emc.comHigh 8.4
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection from console to gain shell access of system.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell.CVE-2025-45378 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell CloudLink, versions 8.0 through 8.1.2, contain vulnerability on restricted shell. A Privileged user with known password can break into command shell of CloudLink server and gain access of shell and escalate privilege, gain unauthorized access of system. If ssh is enabled with web credentials of server, attack is possible through network with known privileged user/password.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2025Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system.CVE-2025-30479 · Other software · Dell · reported by security_alert@emc.comHigh 8.4
Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability.CVE-2025-26484 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2024CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component.CVE-2024-38482 · Other software · Dell · reported by security_alert@emc.comMedium 6.6
CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. A highly privileged malicious user with remote access could potentially exploit this vulnerability, leading to execute unauthorized actions and retrieve sensitive information from the database.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2024Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnerability.CVE-2024-37137 · Other software · Dell · reported by security_alert@emc.comLow 3.8
Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnerability. A local privileged attacker could potentially exploit this vulnerability, leading to privileged information disclosure.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023 CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability.CVE-2023-28076 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
CloudLink 7.1.2 and all prior versions contain a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability leading to some information disclosure.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022Dell CloudLink 7.1.3 and all earlier versions contain an Authentication Bypass Using an Alternate Path or Channel Vulnerability.CVE-2022-34380 · Other software · Dell · reported by security_alert@emc.comCritical 9.3
Dell CloudLink 7.1.3 and all earlier versions contain an Authentication Bypass Using an Alternate Path or Channel Vulnerability. A high privileged local attacker may potentially exploit this vulnerability leading to authentication bypass and access the CloudLink system console. This is critical severity vulnerability as it allows attacker to take control of the system.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022Dell EMC CloudLink 7.1.2 and all prior versions contain an Authentication Bypass Vulnerability.CVE-2022-34379 · Other software · Dell · reported by security_alert@emc.comCritical 9.4
Dell EMC CloudLink 7.1.2 and all prior versions contain an Authentication Bypass Vulnerability. A remote attacker, with the knowledge of the active directory usernames, could potentially exploit this vulnerability to gain unauthorized access to the system.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests.CVE-2022-24414 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attacks.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Dell EMC CloudLink 7.1 and all prior versions contain an Improper Input Validation Vulnerability.CVE-2021-36335 · Other software · Dell · reported by security_alert@emc.comMedium 4.3
Dell EMC CloudLink 7.1 and all prior versions contain an Improper Input Validation Vulnerability. A remote low privileged attacker, may potentially exploit this vulnerability, leading to execution of arbitrary files on the server
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability.CVE-2021-36334 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to arbitrary code execution on end user machine
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Dell EMC CloudLink 7.1 and all prior versions contain a Buffer Overflow Vulnerability.CVE-2021-36333 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell EMC CloudLink 7.1 and all prior versions contain a Buffer Overflow Vulnerability. A local low privileged attacker, may potentially exploit this vulnerability, leading to an application crash.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability.CVE-2021-36332 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability. A remote low privileged attacker, may potentially exploit this vulnerability, directing end user to arbitrary and potentially malicious websites.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Dell EMC CloudLink 7.1 and all prior versions contain an Arbitrary File Creation Vulnerability.CVE-2021-36314 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell EMC CloudLink 7.1 and all prior versions contain an Arbitrary File Creation Vulnerability. A remote unauthenticated attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary files on the end user system.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability.CVE-2021-36313 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker. This vulnerability is considered critical as it may be leveraged to completely compromise the vulnerable application as well as the underlying operating system. Dell recommends customers to upgrade at the earliest opportunity.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability.CVE-2021-36312 · Other software · Dell · reported by security_alert@emc.comCritical 9.1
Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowledge of the hard-coded credentials, may potentially exploit this vulnerability to gain unauthorized access to the system.
- Product
- CloudLink
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2020Huawei CloudLink Board version 20.0.0; DP300 version V500R002C00; RSE6500 versions V100R001C00, V500R002C00, and V500R002C00SPC900; and TE60 versions V500R002C0CVE-2020-1841 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Huawei CloudLink Board version 20.0.0; DP300 version V500R002C00; RSE6500 versions V100R001C00, V500R002C00, and V500R002C00SPC900; and TE60 versions V500R002C00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C10, V600R019C00, and V600R019C00SPC100 have an information leak vulnerability. An unauthenticated, remote attacker can make a large number of attempts to guess information. Successful exploitation may cause information leak.
- Product
- CloudLink Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2019The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability.CVE-2019-5280 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability. Due to insufficient verification of specific parameters of the TLS server certificate, attackers can perform man-in-the-middle attacks, leading to the affected phones registered abnormally, affecting the availability of IP phones.
- Product
- CloudLink Phone 7900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.