Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
May 27, 2026An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain usCVE-2025-14713 · Network & remote access · Synology · reported by security@synology.comHigh 7.5
An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server.
- Product
- C2 Identity Edge Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2026Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the headCVE-2026-26365 · Other software · Akamai · reported by MITREMedium 4
Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2025Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling.CVE-2025-66373 · Other software · Akamai · reported by MITREMedium 4.8
Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes to the origin server. An attacker could hide a smuggled request in these superfluous bytes. Whether this is exploitable depends on the origin server's behavior and how it processes the invalid request it receives from Akamai Ghost.
- Product
- Akamaighost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orgakamai.com
Sep 25, 2025Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability.CVE-2025-26482 · Other software · Dell · reported by security_alert@emc.comMedium 4.9
Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.
- Product
- PowerEdge R770
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability.CVE-2024-0171 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability.CVE-2024-0172 · Other software · Dell · reported by security_alert@emc.comHigh 7.9
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability.CVE-2024-25942 · Other software · Dell · reported by security_alert@emc.comMedium 4.4
Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability. A physical high privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2024Dell PowerEdge Server BIOS contains a heap-based buffer overflow vulnerability.CVE-2024-22453 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell PowerEdge Server BIOS contains a heap-based buffer overflow vulnerability. A local high privileged attacker could potentially exploit this vulnerability to write to otherwise unauthorized memory.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability.CVE-2024-0173 · Other software · Dell · reported by security_alert@emc.comLow 3.8
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability.CVE-2024-0163 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.
- Product
- PowerEdge BIOS Intel 16G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2024-0162 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to out-of-bound read/writes to SMRAM.
- Product
- PowerEdge BIOS Intel 16G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability.CVE-2024-0154 · Other software · Dell · reported by security_alert@emc.comLow 3.8
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2024Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2024-0161 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Dell PowerEdge Server BIOS and Dell Precision Workstation 7910 and 7920 Rack BIOS contain an Improper SMM communication buffer verification vulnerability.CVE-2022-22558 · Other software · Dell · reported by security_alert@emc.comMedium 5.7
Dell PowerEdge Server BIOS and Dell Precision Workstation 7910 and 7920 Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A Local High Privileged attacker could potentially exploit this vulnerability leading to arbitrary writes or denial of service.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2.CVE-2021-40389 · Other software · Advantech · reported by talos-cna@cisco.comHigh 8.8
A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Deviceon/iedge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 14, 2021Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability.CVE-2021-21557 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of service, arbitrary code execution, or information disclosure in System Management Mode.
- Product
- PowerEdge BIOS Intel 15G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2015The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie.CVE-2015-7253 · Other software · Commvault · reported by cret@cert.orgHigh 10
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie.
- Product
- Edge Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Feb 13, 2008Multiple integer overflows in the Edge server in Adobe Flash Media Server 2 before 2.0.5, and Connect Enterprise Server 6 before SP3, allow remote attackers to CVE-2007-6149 · Other software · Adobe · reported by MITREHigh 10
Multiple integer overflows in the Edge server in Adobe Flash Media Server 2 before 2.0.5, and Connect Enterprise Server 6 before SP3, allow remote attackers to execute arbitrary code via a Real Time Message Protocol (RTMP) message with a crafted integer field that is used for allocation.
- Product
- Connect Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.idefense.comsecunia.com
Feb 13, 2008Use-after-free vulnerability in the Edge server in Adobe Flash Media Server 2 before 2.0.5, and Connect Enterprise Server 6 before SP3, allows remote attackers CVE-2007-6148 · Other software · Adobe · reported by MITREHigh 10
Use-after-free vulnerability in the Edge server in Adobe Flash Media Server 2 before 2.0.5, and Connect Enterprise Server 6 before SP3, allows remote attackers to execute arbitrary code via an unspecified sequence of Real Time Message Protocol (RTMP) requests.
- Product
- Connect Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.idefense.comsecunia.com
Feb 11, 2008Cross-site scripting (XSS) vulnerability in Caching Proxy (CP) 5.1 through 6.1 in IBM WebSphere Edge Server, when CGI mapping rules are enabled, allows remote aCVE-2008-0717 · Other software · IBM · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Caching Proxy (CP) 5.1 through 6.1 in IBM WebSphere Edge Server, when CGI mapping rules are enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger injection into an error response.
- Product
- Websphere Edge Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comwww-1.ibm.com
Aug 6, 2004WebSphere Edge Component Caching Proxy in WebSphere Edge Server 5.02, with the JunctionRewrite directive enabled, allows remote attackers to cause a denial of sCVE-2004-0684 · Other software · IBM · reported by MITREMedium 5
WebSphere Edge Component Caching Proxy in WebSphere Edge Server 5.02, with the JunctionRewrite directive enabled, allows remote attackers to cause a denial of service via an HTTP GET request without any parameters.
- Product
- Websphere Caching Proxy Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.