Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Sep 1, 2026Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.CVE-2026-10420 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 102d3dc75cf8e58e68e4bea54ae3c803992c91be.
- Product
- mTower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.CVE-2026-82927 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before 06994e303637512e39062f3e037c222e8448e57e.
- Product
- mTower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation.CVE-2026-82926 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.5
NULL pointer dereference vulnerability in Samsung Open Source mTower allows Pointer Manipulation. This issue affects mTower: before afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a.
- Product
- mTower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022A Memory Allocation with Excessive Size Value vulnerablity in the TEE_Realloc function in Samsung mTower through 0.3.0 allows a trusted application to trigger aCVE-2022-40762 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
A Memory Allocation with Excessive Size Value vulnerablity in the TEE_Realloc function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_Realloc with an excessive number for the parameter len.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022The function tee_obj_free in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_AllocatCVE-2022-40761 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
The function tee_obj_free in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_AllocateOperation with a disturbed heap layout, related to utee_cryp_obj_alloc.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigger aCVE-2022-40760 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_MACUpdate with an excessive size value of chunkSize.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022A NULL pointer dereference issue in the TEE_MACCompareFinal function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of ServiceCVE-2022-40759 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
A NULL pointer dereference issue in the TEE_MACCompareFinal function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_MACCompareFinal with a NULL pointer for the parameter operation.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022A Buffer Access with Incorrect Length Value vulnerablity in the TEE_CipherUpdate function in Samsung mTower through 0.3.0 allows a trusted application to triggeCVE-2022-40758 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
A Buffer Access with Incorrect Length Value vulnerablity in the TEE_CipherUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_CipherUpdate with an excessive size value of srcLen.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACComputeFinal function in Samsung mTower through 0.3.0 allows a trusted application to triCVE-2022-40757 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACComputeFinal function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_MACComputeFinal with an excessive size value of messageLen.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2022sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coordinates, leading to a denial of serviceCVE-2022-39830 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coordinates, leading to a denial of service.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2022There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP_CIPHER_CTX_new.CVE-2022-39829 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the return value of EVP_CIPHER_CTX_new.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2022sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading to a denial of service.CVE-2022-39828 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading to a denial of service.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_GetObjectInfo1.CVE-2022-36622 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_GetObjectInfo1.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_AllocateTransientObject.CVE-2022-36621 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
Samsung Electronics mTower v0.3.0 and earlier was discovered to contain a NULL pointer dereference via the function TEE_AllocateTransientObject.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a NumakCVE-2022-38155 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.5
TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a Numaker-PFM-M2351 TEE kernel crash.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2022The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of servCVE-2022-35858 · Computers, phones & browsers · Samsung · reported by MITREHigh 7.8
The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of service, and information disclosure by invoking the function TEE_PopulateTransientObject with a large number in the parameter attrCount.
- Product
- Mtower
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.