Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
16 results
Oct 6, 2026Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereferenCVE-2026-43598 · Other software · AMD · reported by psirt@amd.comHigh 7.7
Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereference an attacker-controlled pointer, potentially resulting in remote code execution.
- Product
- AMD Instinct™ MI210
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potentially leading to arbCVE-2023-20511 · Other software · AMD · reported by psirt@amd.comMedium 6.4
Release of an invalid pointer in the AMD kernel mode driver (KMD) could allow a privileged attacker to create a double free condition potentially leading to arbitrary code execution.
- Product
- AMD Radeon™ Instinct™ MI25 Graphics Products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2026Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU conCVE-2026-0481 · Other software · AMD · reported by psirt@amd.comCritical 9.2
Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could allow a remote attacker to perform unauthorized changes to the GPU configuration, potentially resulting in loss of availability
- Product
- AMD Instinct™ MI210
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2026An out of bounds read in the remote management firmware could allow a privileged attacker read a limited section of memory outside of established bounds potentiCVE-2024-21950 · Other software · AMD · reported by psirt@amd.comLow 1.8
An out of bounds read in the remote management firmware could allow a privileged attacker read a limited section of memory outside of established bounds potentially resulting in loss of confidentiality or availability.
- Product
- AMD Instinct™ MI300X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS to write invalid daCVE-2026-0428 · Other software · AMD · reported by psirt@amd.comLow 1.8
Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS to write invalid data to a remote Die, potentially resulting in unexpected behavior.
- Product
- AMD Instinct™ MI300A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to access these shared CVE-2026-0427 · Other software · AMD · reported by psirt@amd.comMedium 4.6
Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to access these shared resources from another Guest VM, potentially resulting in the loss of confidentiality, integrity, or availability.
- Product
- AMD Instinct™ MI210
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Out of bounds write in AMD AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.CVE-2025-54517 · Other software · AMD · reported by psirt@amd.comHigh 8.5
Out of bounds write in AMD AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.
- Product
- AMD Instinct™ MI250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2026An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messages to the system managCVE-2023-31313 · Other software · AMD · reported by psirt@amd.comHigh 7.2
An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messages to the system management unit (SMU) potentially resulting in arbitrary code execution.
- Product
- AMD Instinct™ MI210
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2026Deep Instinct Windows Agent 1.2.29.0 contains an unquoted service path vulnerability in the DeepMgmtService that allows local users to potentially execute code CVE-2020-37047 · Other software · Deepinstinct · reported by VulnCheckHigh 8.5
Deep Instinct Windows Agent 1.2.29.0 contains an unquoted service path vulnerability in the DeepMgmtService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files\HP Sure Sense\DeepMgmtService.exe to inject malicious code that would execute with LocalSystem permissions during service startup.
- Product
- Deep Instinct Windows Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeepinstinct.comexploit-db.com
Jan 25, 2026Deep Instinct Windows Agent 1.2.24.0 contains an unquoted service path vulnerability in the DeepNetworkService that allows local users to potentially execute coCVE-2020-36934 · Other software · Deepinstinct · reported by VulnCheckHigh 8.5
Deep Instinct Windows Agent 1.2.24.0 contains an unquoted service path vulnerability in the DeepNetworkService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files\HP Sure Sense\DeepNetworkService.exe to inject malicious code that would execute with LocalSystem permissions during service startup.
- Product
- Deep Instinct Windows Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeepinstinct.comdeepinstinct.com
Sep 23, 2025Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate Redfish® API commands to remove files froCVE-2024-21935 · Other software · AMD · reported by psirt@amd.comMedium 5
Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to manipulate Redfish® API commands to remove files from the local root directory, potentially resulting in data corruption.
- Product
- AMD Instinct™ MI300X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2025Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain special characters in manipulated RedfisCVE-2024-21927 · Other software · AMD · reported by psirt@amd.comMedium 5
Improper input validation in Satellite Management Controller (SMC) may allow an attacker with privileges to use certain special characters in manipulated Redfish® API commands, causing service processes like OpenBMC to crash and reset, potentially resulting in denial of service.
- Product
- AMD Instinct™ MI300X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write pasCVE-2025-0034 · Other software · AMD · reported by psirt@amd.comMedium 4.7
Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write past the end of allocated arrays, potentially resulting in a loss of platform integrity or denial of service.
- Product
- AMD Instinct™ MI300X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input data potentially causiCVE-2024-36346 · Other software · AMD · reported by psirt@amd.comMedium 6
Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input data potentially causing a GPU Reset condition.
- Product
- AMD Instinct™ MI300A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2025Improper handling of insufficiency privileges in the ASP could allow a privileged attacker to modify Translation Map Registers (TMRs) potentially resulting in lCVE-2023-20516 · Other software · AMD · reported by psirt@amd.comLow 3.3
Improper handling of insufficiency privileges in the ASP could allow a privileged attacker to modify Translation Map Registers (TMRs) potentially resulting in loss of confidentiality or integrity.
- Product
- AMD Instinct™ MI250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2024A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL.CVE-2024-28287 · Other software · gbgplc · reported by MITREHigh 7.3
A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL.
- Product
- instinct
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.