Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

59 results · page 1 of 2

Oct 28, 2026Local privilege escalation due to improper authentication.CVE-2025-30414 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 42569, Acronis Cyber Protect 17 (Windows) before build 42587.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 9, 2026A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKCVE-2026-79696 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cCritical 10
A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session replay.
Product
Agent Development Kit (ADK) for Python
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 4, 2026A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticCVE-2026-79707 · Computers, phones & browsers · Google Cloud · reported by f45cbf4e-4146-4068-b7e1-655ffc2c548cHigh 8.7
A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter.
Product
Agent Development Kit (ADK)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 5, 2026Default credentials set for local privileged user in Virtual Appliance.CVE-2026-28713 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before build 36943, Acronis Cyber Protect 17 (VMware) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Mar 5, 2026Credentials are not deleted from Acronis Agent after plan revocation.CVE-2025-30413 · Other software · Acronis · reported by security@acronis.comMedium 4.4
Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40497, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Mar 5, 2026Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-11792 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 41124.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Mar 5, 2026Credentials are not deleted from Acronis Agent after plan revocation.CVE-2025-11790 · Other software · Acronis · reported by security@acronis.comMedium 4.4
Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Feb 19, 2026Sensitive data disclosure and manipulation due to missing authentication.CVE-2025-30410 · Other software · Acronis · reported by security@acronis.comCritical 9.8
Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 39870, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 41800.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Nov 10, 2025The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commCVE-2025-43079 · Other software · Qualys Inc · reported by bugreport@qualys.comMedium 6.3
The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. This behavior can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges.
Product
Qualys Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualys.com
Aug 28, 2025Local privilege escalation due to insecure folder permissions.CVE-2025-9578 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40734.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Aug 28, 2025Local privilege escalation due to improper soft link handling.CVE-2025-48963 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jun 4, 2025Local privilege escalation due to insecure file permissions.CVE-2025-48959 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40077.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jun 4, 2025Denial of service due to improper handling of malformed input.CVE-2025-30415 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40077, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Apr 24, 2025Denial of service due to allocation of resources without limits.CVE-2025-30409 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 17 (Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Apr 24, 2025Local privilege escalation due to insecure folder permissions.CVE-2025-30408 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 16 (Windows) before build 39938.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Mar 26, 2025Local privilege escalation due to a binary hijacking vulnerability.CVE-2025-30407 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39713.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to unquoted search path vulnerability.CVE-2025-24831 · Other software · Acronis · reported by security@acronis.comMedium 6.6
Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24830 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24829 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24828 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24827 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Dec 23, 2024Weak algorithm used to sign RPM package.CVE-2024-55539 · Other software · Acronis · reported by security@acronis.comLow 2.5
Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux) before build 39185, Acronis Cyber Protect 16 (Linux) before build 39938.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 23, 2024Local active protection service settings manipulation due to unnecessary privileges assignment.CVE-2024-8903 · Other software · Acronis · reported by security@acronis.comMedium 4.7
Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows, macOS) before build 38565.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 16, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-8766 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38235, Acronis Cyber Protect 16 (Windows) before build 39169.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 16, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-34016 · Other software · Acronis · reported by security@acronis.comMedium 6.5
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38235.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
May 29, 2024In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agentCVE-2024-36365 · Other software · JetBrains · reported by cve@jetbrains.comMedium 6.8
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com jetbrains.com
Apr 29, 2024Local privilege escalation due to insecure folder permissions.CVE-2024-34011 · Other software · Acronis · reported by security@acronis.comMedium 6.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 37758.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 29, 2024Local privilege escalation due to unquoted search path vulnerability.CVE-2024-34010 · Other software · Acronis · reported by security@acronis.comHigh 8.2
Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 37758, Acronis Cyber Protect 16 (Windows) before build 38690, Acronis True Image (Windows) before build 42386, Acronis True Image OEM (Windows) before build 42575.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 29, 2024Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-48684 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 37758, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 29, 2024Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-48683 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 37758, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 26, 2024JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions.CVE-2023-26603 · Other software · jumpcloud · reported by MITREMedium 5.9
JumpCloud Agent before 1.178.0 Creates a Temporary File in a Directory with Insecure Permissions. This allows privilege escalation to SYSTEM via a repair action in the installer.
Product
jumpcloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.jumpcloud.com github.com
Jan 11, 2024Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments.CVE-2024-21669 · Other software · hyperledger · reported by GitHubCritical 9.9
Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-mobile environments. When verifying W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDP-VCs), the result of verifying the presentation `document.proof` was not factored into the final `verified` value (`true`/`false`) on the presentation record. The flaw enables holders of W3C Format Verifiable Credentials using JSON-LD with Linked Data Proofs (LDPs) to present incorrectly constructed proofs, and allows malicious verifiers to save and replay a presentation from such holders as their own. This vulnerability has been present since version 0.7.0 and fixed in version 0.10.5.
Product
aries-cloudagent-python
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 14, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-48676 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36943.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 9, 2023Local privilege escalation due to DLL hijacking vulnerability.CVE-2023-45248 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36497, Acronis Cyber Protect 16 (Windows) before build 37391.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 9, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-45247 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36497, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 6, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-45246 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36343, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 6, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-45244 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35895, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 37391.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 5, 2023Sensitive information disclosure due to missing authorization.CVE-2023-45243 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 5, 2023Sensitive information disclosure due to missing authorization.CVE-2023-45242 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 5, 2023Sensitive information leak through log files.CVE-2023-45241 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 37391.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 5, 2023Sensitive information disclosure due to excessive collection of system information.CVE-2023-44213 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 35739, Acronis Cyber Protect 16 (Windows) before build 37391.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 5, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-44211 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 31637, Acronis Cyber Protect 16 (Linux, Windows) before build 37391.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 4, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-44210 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 29258, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 4, 2023Local privilege escalation due to improper soft link handling.CVE-2023-44209 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 29051, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 18, 2023 Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only CVE-2023-28143 · Other software · Qualys · reported by bugreport@qualys.comMedium 6.7
Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only on older macOSX (macOS 10.15 and older) versions. Attackers may exploit incorrect file permissions to give them ROOT command execution privileges on the host. During the install of the PKG, a step in the process involves extracting the package and copying files to several directories. Attackers may gain writable access to files during the install of PKG when extraction of the package and copying files to several directories, enabling a local escalation of privilege.
Product
Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualys.com qualys.com
Apr 18, 2023 A Race Condition exists in the Qualys Cloud Agent for Windows platform in versions from 3.1.3.34 and before 4.5.3.1.CVE-2023-28142 · Other software · Qualys · reported by bugreport@qualys.comMedium 6.7
A Race Condition exists in the Qualys Cloud Agent for Windows platform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers to escalate privileges limited on the local machine during uninstallation of the Qualys Cloud Agent for Windows. Attackers may gain SYSTEM level privileges on that asset to run arbitrary commands. At the time of this disclosure, versions before 4.0 are classified as End of Life.
Product
Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualys.com qualys.com
Apr 18, 2023 An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31.CVE-2023-28141 · Other software · Qualys · reported by bugreport@qualys.comMedium 6.7
An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31. Attackers may write files to arbitrary locations via a local attack vector. This allows attackers to assume the privileges of the process, and they may delete or otherwise on unauthorized files, allowing for the potential modification or deletion of sensitive files limited only to that specific directory/file object. This vulnerability is bounded to the time of installation/uninstallation and can only be exploited locally. At the time of this disclosure, versions before 4.0 are classified as End of Life.
Product
Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualys.com qualys.com
Apr 18, 2023 An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1.CVE-2023-28140 · Other software · Qualys · reported by bugreport@qualys.comMedium 6.7
An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a malicious copy of a Dependency Link Library (DLL) via a local attack vector instead of the DLL that the application was expecting, when processes are running with escalated privileges. This vulnerability is bounded only to the time of uninstallation and can only be exploited locally. At the time of this disclosure, versions before 4.0 are classified as End of Life.
Product
Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualys.com qualys.com
Mar 5, 2023Use of hard-coded credentials vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to obtaiCVE-2023-22344 · Other software · DOS Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
Use of hard-coded credentials vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to obtain the password of the debug tool and execute it. As a result of exploiting this vulnerability with CVE-2023-22335 and CVE-2023-22336 vulnerabilities together, it may allow a remote attacker to execute an arbitrary code with SYSTEM privileges by sending a specially crafted script to the affected device.
Product
SS1 and Rakuraku PC Cloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp dos-osaka.co.jp
Mar 5, 2023Path traversal vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to upload a specially cCVE-2023-22336 · Other software · DOS Co., Ltd. · reported by vultures@jpcert.or.jpCritical 9.8
Path traversal vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to upload a specially crafted file to an arbitrary directory. As a result of exploiting this vulnerability with CVE-2023-22335 and CVE-2023-22344 vulnerabilities together, it may allow a remote attacker to execute an arbitrary code with SYSTEM privileges by sending a specially crafted script to the affected device.
Product
SS1 and Rakuraku PC Cloud
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp dos-osaka.co.jp

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.