Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
26 results
Nov 11, 2025Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow.CVE-2025-13032 · Other software · Avast · reported by security@nortonlifelock.comCritical 9.9
Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privelages via pool overflow.
- Product
- (Free/Premiium/Ultimeat) Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability.CVE-2024-7237 · Other software · AVG · reported by zdi-disclosures@trendmicro.comHigh 7.8
AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AVG Service. By creating a symbolic link, an attacker can abuse the service to delete a folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22960.
- Product
- AntiVirus Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024AVG AntiVirus Free icarus Arbitrary File Creation Denial of Service Vulnerability.CVE-2024-7236 · Other software · AVG · reported by zdi-disclosures@trendmicro.comMedium 5.5
AVG AntiVirus Free icarus Arbitrary File Creation Denial of Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AVG Installer. By creating a symbolic link, an attacker can abuse the update functionality to create a file. An attacker can leverage this vulnerability to create a persistent denial-of-service condition on the system. Was ZDI-CAN-22942.
- Product
- AntiVirus Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024AVG AntiVirus Free Link Following Denial-of-Service Vulnerability.CVE-2024-7235 · Other software · AVG · reported by zdi-disclosures@trendmicro.comMedium 5.5
AVG AntiVirus Free Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AVG Service. By creating a symbolic link, an attacker can abuse the service to create a folder. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. . Was ZDI-CAN-22803.
- Product
- AntiVirus Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability.CVE-2024-7234 · Other software · AVG · reported by zdi-disclosures@trendmicro.comHigh 7.8
AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of AVG AntiVirus Free. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AVG Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22260.
- Product
- AntiVirus Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests.CVE-2023-5760 · Other software · Avast/AVG · reported by security@nortonlifelock.comHigh 8.2
A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability which can be further exploited, allowing an attacker to gain full local privilege escalation on the system.This issue affects Avast/Avg Antivirus: 23.8.
- Product
- Avast/Avg Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.norton.comsupport.norton.com
Apr 19, 2023Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface.CVE-2023-1587 · Other software · AVAST · reported by security@nortonlifelock.comMedium 5.8
Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface. The issue was fixed with Avast and AVG Antivirus version 22.11
- Product
- Avast Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.norton.comsupport.norton.com
Apr 19, 2023Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the restore process leading to arbitrary file creCVE-2023-1586 · Other software · Avast · reported by security@nortonlifelock.comMedium 6.5
Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the restore process leading to arbitrary file creation. The issue was fixed with Avast and AVG Antivirus version 22.11
- Product
- Avast Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.norton.comsupport.norton.com
Apr 19, 2023Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leading to arbitrary fileCVE-2023-1585 · Other software · Avast · reported by security@nortonlifelock.comMedium 6.5
Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leading to arbitrary file/directory deletion. The issue was fixed with Avast and AVG Antivirus version 22.11 and virus definitions from 14 February 2023 or later.
- Product
- Avast Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.norton.comsupport.norton.com
Jan 10, 2023Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may CVE-2022-4294 · Other software · NortonLifelock (GenDigital) · reported by security@nortonlifelock.comHigh 7.1
Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
- Product
- Norton Antivirus Windows Eraser Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.norton.comsupport.norton.com
Dec 5, 2022A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem, to escalate his priCVE-2022-4173 · Other software · NortonLifeLock · reported by security@nortonlifelock.comHigh 7.3
A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avast and AVG Antivirus version 22.10.
- Product
- Avast and AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.norton.comsupport.norton.com
Jun 29, 2020An elevation of privilege vulnerability exists in Avast Free Antivirus and AVG AntiVirus Free before 20.4 due to improperly handling hard links.CVE-2020-13657 · Other software · Avast · reported by MITREMedium 5.5
An elevation of privilege vulnerability exists in Avast Free Antivirus and AVG AntiVirus Free before 20.4 due to improperly handling hard links. The vulnerability allows local users to take control of arbitrary files.
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.avast.comforum.avast.com
Nov 1, 2019A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowingCVE-2019-18654 · Other software · AVG · reported by MITREMedium 6.1
A Cross Site Scripting (XSS) issue exists in AVG AntiVirus (Internet Security Edition) 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name.
- Product
- Anti-virus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfirstsight.memedium.com
Oct 23, 2019An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8.CVE-2019-17093 · Other software · Avast · reported by MITREHigh 7.8
An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\system32\wbemcomn.dll, which is loaded into a protected-light process (PPL) and might bypass some of the self-defense mechanisms. This affects all components that use WMI, e.g., AVGSvc.exe 19.6.4546.0 and TuneupSmartScan.dll 19.1.884.0.
- Product
- Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsafebreach.comsafebreach.com
Jul 12, 2017AVG AntiVirus for MacOS with scan engine before 4668 might allow remote attackers to bypass malware detection by leveraging failure to scan inside disk image (aCVE-2017-9977 · Other software · AVG · reported by MITREHigh 7.5
AVG AntiVirus for MacOS with scan engine before 4668 might allow remote attackers to bypass malware detection by leveraging failure to scan inside disk image (aka DMG) files.
- Product
- Anti-virus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwwws.nightwatchcybersecurity.comwwws.nightwatchcybersecurity.com
Mar 21, 2017Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a loCVE-2017-5566 · Other software · AVG · reported by MITREMedium 6.7
Code injection vulnerability in AVG Ultimate 17.1 (and earlier), AVG Internet Security 17.1 (and earlier), and AVG AntiVirus FREE 17.1 (and earlier) allows a local attacker to bypass a self-protection mechanism, inject arbitrary code, and take full control of any AVG process via a "DoubleAgent" attack. One perspective on this issue is that (1) these products do not use the Protected Processes feature, and therefore an attacker can enter an arbitrary Application Verifier Provider DLL under Image File Execution Options in the registry; (2) the self-protection mechanism is intended to block all local processes (regardless of privileges) from modifying Image File Execution Options for these products; and (3) this mechanism can be bypassed by an attacker who temporarily renames Image File Execution Options during the attack.
- Product
- Anti-virus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybellum.comcybellum.com
Dec 31, 2012The Anti-theft service in AVG AntiVirus for Android allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPCVE-2012-6335 · Other software · AVG · reported by MITRELow 3.3
The Anti-theft service in AVG AntiVirus for Android allows physically proximate attackers to provide arbitrary location data via a "commonly available simple GPS location spoofer."
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthehackernews.comthehackernews.com
Jul 30, 2008The files parsing engine in Grisoft AVG Anti-Virus before 8.0.156 allows remote attackers to cause a denial of service (engine crash) via a crafted UPX compressCVE-2008-3373 · Other software · Grisoft · reported by MITREMedium 5
The files parsing engine in Grisoft AVG Anti-Virus before 8.0.156 allows remote attackers to cause a denial of service (engine crash) via a crafted UPX compressed file, which triggers a divide-by-zero error.
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comgrisoft.com
Jul 15, 2007avg7core.sys 7.5.0.444 in Grisoft AVG Anti-Virus 7.5.448 and Free Edition 7.5.446, provides an internal function that copies data to an arbitrary address, whichCVE-2007-3777 · Other software · Grisoft · reported by MITREHigh 7.2
avg7core.sys 7.5.0.444 in Grisoft AVG Anti-Virus 7.5.448 and Free Edition 7.5.446, provides an internal function that copies data to an arbitrary address, which allows local users to gain privileges via arbitrary address arguments to a function provided by the 0x5348E004 IOCTL for the generic DeviceIoControl handler.
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2006Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors involving an uninitialized variable and a crafted CAB file.CVE-2006-5938 · Other software · Grisoft · reported by MITREHigh 10
Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors involving an uninitialized variable and a crafted CAB file.
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2006Unspecified vulnerability in Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors related to "Integer Issues" and parsing of .EXE CVE-2006-5940 · Other software · Grisoft · reported by MITREHigh 10
Unspecified vulnerability in Grisoft AVG Anti-Virus before 7.1.407 has unknown impact and remote attack vectors related to "Integer Issues" and parsing of .EXE files.
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2006Grisoft AVG Anti-Virus before 7.1.407 allows remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers a divide-by-zero error.CVE-2006-5939 · Other software · Grisoft · reported by MITREHigh 7.8
Grisoft AVG Anti-Virus before 7.1.407 allows remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers a divide-by-zero error. NOTE: some of these details are obtained from third party information.
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2006Multiple integer overflows in Grisoft AVG Anti-Virus before 7.1.407 allow remote attackers to execute arbitrary code via crafted (1) CAB or (2) RAR archives thaCVE-2006-5937 · Other software · Grisoft · reported by MITREHigh 7.5
Multiple integer overflows in Grisoft AVG Anti-Virus before 7.1.407 allow remote attackers to execute arbitrary code via crafted (1) CAB or (2) RAR archives that trigger a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 9, 2006Grisoft AVG Free 7.1, and other versions including 7.0.308, sets Everyone/Full Control permissions for certain update files including (1) upd_vers.cfg, (2) incaCVE-2006-1125 · Other software · Grisoft · reported by MITREMedium 4.6
Grisoft AVG Free 7.1, and other versions including 7.0.308, sets Everyone/Full Control permissions for certain update files including (1) upd_vers.cfg, (2) incavi.avm, and (3) unspecified drivers, which might allow local users to gain privileges.
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com
Oct 30, 2005Multiple interpretation error in AVG 7 7.0.323 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte seCVE-2005-3371 · Other software · Grisoft · reported by MITREMedium 5.1
Multiple interpretation error in AVG 7 7.0.323 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmarc.infosecurityelf.org
Oct 14, 2005Multiple interpretation error in unspecified versions of Grisoft AVG Antivirus allows remote attackers to bypass virus detection via a malicious executable in aCVE-2005-3234 · Other software · Grisoft · reported by MITREMedium 5.1
Multiple interpretation error in unspecified versions of Grisoft AVG Antivirus allows remote attackers to bypass virus detection via a malicious executable in a specially crafted RAR file with malformed central and local headers, which can still be opened by products such as Winrar and PowerZip, even though they are rejected as corrupted by Winzip and BitZipper.
- Product
- AVG Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.