huawei has 67 CVEs on record between 2016 and 2026. Disclosure cadence is accelerating: 15 in the last 90 days against 0 in the 90 before. The busiest recent month was December 2025 with 16. The median CVSS is 5.5 (medium). 1% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-264 (20) and CWE-362 (8). Most affected products: HarmonyOS (61), emui (2), openBMC (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 1% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —(1)
- Last 90 days
- 15 prev 0
Weakness classes
Products
- HarmonyOS 61
- emui 2
- openBMC 2
- anyoffice 1
- openUBMC 1
Worst active — by depth score
CVE-2016-3081High· 8.1Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.89CVE-2026-65198High· 8.6Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy47CVE-2026-49310High· 8.6Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.47CVE-2025-66328High· 8.4Multi-thread race condition vulnerability in the network management module46CVE-2025-66324High· 8.4Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity.46
huawei vulnerabilities
CVEs affecting huawei, newest first. Open any entry for full detail, references, and exploit status.
67 CVEsRSS
CVE-2026-65200Low· 3.5The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supp…
The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supp…
CVE-2026-65199Medium· 5.4openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account…
CVE-2026-65198High· 8.6Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from,…
CVE-2026-81645Medium· 5.9Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.
Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.
CVE-2026-49313Medium· 5.5Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2026-81644Medium· 4.3DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability.
DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2026-49309Medium· 4.8Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2026-41987Medium· 6.2Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2026-49314High· 7.3OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability.
OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2026-49312Medium· 4.0Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2026-49311Medium· 6.2Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability.
Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2026-49310High· 8.6Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2026-81646Medium· 5.9Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.
Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2026-81647Medium· 5.3Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.
Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2026-49315High· 7.1DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability.
DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66334Low· 3.3Denial of service (DoS) vulnerability in the office service
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66333Low· 3.3Denial of service (DoS) vulnerability in the office service
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66332Low· 3.3Denial of service (DoS) vulnerability in the office service
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66331Low· 3.3Denial of service (DoS) vulnerability in the office service
Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66330Medium· 4.9App lock verification bypass vulnerability in the file management app
App lock verification bypass vulnerability in the file management app. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-66329Medium· 4.0Permission control vulnerability in the window management module
Permission control vulnerability in the window management module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66328High· 8.4Multi-thread race condition vulnerability in the network management module
Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66327High· 7.1Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-66325Medium· 6.2Permission control vulnerability in the package management module
Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-58279Medium· 4.4Permission control vulnerability in the media library module
Permission control vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2025-66326Medium· 6.7Race condition vulnerability in the audio module
Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66324High· 8.4Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity.
Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affect app data integrity.
CVE-2025-66323Medium· 5.3Vulnerability of improper criterion security check in the card module
Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66322Medium· 5.1Multi-thread race condition vulnerability in the camera framework module
Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-66321Medium· 5.1Multi-thread race condition vulnerability in the camera framework module
Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.