Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Oct 19, 2026Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal sCVE-2026-12254 · Other software · Netskope Inc. · reported by psirt@netskope.comMedium 6.4
Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via the Captive Portal using a rogue access point to either access malicious sites or exfiltrate data.The issue impacts all versions prior to R142
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141.CVE-2026-15710 · Other software · Netskope · reported by psirt@netskope.comMedium 6.8
An information leakage vulnerability exists in the Endpoint DLP component (epdlpdrv.sys) of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message validation, allowing local unprivileged processes to send unauthorized queries. Additionally, a reply buffer used by the port message handler was not properly initialized before returning data, leaking residual kernel pool memory from prior allocations. A local unprivileged attacker could exploit this vulnerability to enumerate DLP configuration and feature flags, extract live session tokens, and read kernel memory fragments from other users' operations.
- Product
- Endpoint DLP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2026Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP (EPDLP) service of the Netskope Client.CVE-2026-16172 · Other software · Netskope · reported by psirt@netskope.comMedium 6
Netskope was notified of an out-of-bounds heap read affecting the Endpoint DLP (EPDLP) service of the Netskope Client. A local standard user could potentially send a specially crafted message that is not properly validated with a bounds check, likely crashing the kernel driver handler. Successful exploitation could potentially crash the EPDLP service, temporarily interrupting DLP enforcement. A successful exploit could potentially also reveal per-boot memory layout information to unauthorized users.
- Product
- Endpoint DLP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing theCVE-2025-15642 · Other software · Netskope · reported by psirt@netskope.comMedium 6.8
Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lead to bypassing the NSClient Tamper Protections due to weak Discretionary Access Control List (DACLs) on the service object and related registry keys,. * Product Name: Netskope Client * Affected Platform: Windows * Affected Version: All version below R138
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2026Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially CVE-2025-15641 · Other software · Netskope · reported by psirt@netskope.comMedium 6.8
Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileges can potentially tamper with the customer IOCTL by sending crafted IOCTL requests to the driver. A successful exploit can result in the bypassing of all anti-tampering protections for the NSClient.Affected Product(s) and Version(s) * Product Name: Netskope Client * Affected Platform: Windows * Affected Version: All version below R138
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026Netskope was notified about a potential gap in the Endpoint DLP Module for Netskope Client on Windows systems.CVE-2026-2810 · Other software · Netskope · reported by psirt@netskope.comMedium 6.8
Netskope was notified about a potential gap in the Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an out-of-bounds read within a driver, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.
- Product
- Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.netskope.comnetskope.com
Mar 17, 2026Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems.CVE-2026-2809 · Other software · Netskope · reported by psirt@netskope.comMedium 6.7
Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow a privileged user to trigger an integer overflow within the DLL Injector, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.
- Product
- Endpoint DLP Module for Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2026Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems.CVE-2025-15584 · Other software · Netskope · reported by psirt@netskope.comMedium 6.8
Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems. The successful exploitation of the gap can potentially allow an unprivileged user to trigger an integer overflow within the filter communication port, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation would require the Endpoint DLP module to be enabled in the client configuration. A successful exploit can potentially result in a denial-of-service for the local machine.
- Product
- Endpoint DLP Module for Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025Netskope was notified about a potential gap in its agent (NS Client) on Windows systems.CVE-2025-11156 · Other software · Netskope · reported by psirt@netskope.comMedium 5.9
Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers the flaw, causing a system crash (Blue-Screen-of-Death) and resulting in a Denial of Service (DoS) for the affected machine.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025Netskope was notified about a potential gap in its agent (NS Client) on Windows systems.CVE-2025-5942 · Other software · Netskope · reported by psirt@netskope.comMedium 5.7
Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, an unprivileged user can trigger a heap overflow in the epdlpdrv.sys driver, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation can also potentially be performed by an unprivileged user whose NS Client is configured to use Endpoint DLP. A successful exploit can result in a denial-of-service for the local machine.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025Netskope is notified about a potential gap in its agent (NS Client) in which a malicious actor could trigger a memory leak by sending a crafted DNS packet to a CVE-2025-5941 · Other software · Netskope · reported by psirt@netskope.comLow 2
Netskope is notified about a potential gap in its agent (NS Client) in which a malicious actor could trigger a memory leak by sending a crafted DNS packet to a machine. A successful exploitation may require administrative privileges on the machine, based on the exact configuration. A successful exploit can potentially result in user-controllable memory being leaked in a domain name stored on the local machine.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system.CVE-2025-0309 · Other software · Netskope · reported by psirt@netskope.comMedium 6
An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.amberwolf.comnetskope.com
Aug 14, 2025Netskope has identified a potential gap in its agent (Netskope Client) in which a malicious insider can potentially tamper the Netskope Client configuration by CVE-2024-7402 · Other software · Netskope · reported by psirt@netskope.comHigh 7
Netskope has identified a potential gap in its agent (Netskope Client) in which a malicious insider can potentially tamper the Netskope Client configuration by performing MITM (Man-in-the-Middle) activity on the Netskope Client communication channel. A successful exploitation would require administrative privileges on the machine, and could result in temporarily altering the configuration of Netskope Client or permanently disabling or removing the agent from the machine.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”.CVE-2024-13177 · Other software · Netskope · reported by psirt@netskope.comMedium 5.2
Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the path of the file “nsinstallation”. A standard user could potentially create a symlink of the file “nsinstallation” to escalate the privileges of a different file on the system. This issue affects Netskope Client: before 123.0, before 117.1.11.2310, before 120.1.10.2306.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter.CVE-2024-7401 · Other software · Netskope · reported by psirt@netskope.comHigh 8.5
Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Since this is a static token, if leaked, cannot be rotated or revoked. A malicious actor can use this token to enroll NSClient from a customer’s tenant and impersonate a user.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.netskope.comquickskope.com
Nov 6, 2023Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope clCVE-2023-4996 · Other software · Netskope · reported by psirt@netskope.comMedium 6.6
Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope client by using a specially-crafted package. The root cause of the problem was a user control code when called by a Windows ServiceController did not validate the permissions associated with the user before executing the user control code. This user control code had permissions to terminate the NSClient service.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetskope.comnetskope.com
Jun 15, 2023The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for CVE-2022-4149 · Other software · Netskope · reported by psirt@netskope.comHigh 7
The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Whenever the Netskope client service restarts, it deletes the logplaceholder and recreates, creating a race condition, which can be exploited by a malicious local user to create the file and set ACL permissions on the file. Once the file is created by a malicious user with proper ACL permissions, all files within C:\Users\Public\netSkope\ becomes modifiable by the unprivileged user. By using Windows pseudo-symlink, these files can be pointed to other places in the system and thus malicious users will be able to elevate privileges.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetskope.comnetskope.com
Jun 15, 2023The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands.CVE-2023-2270 · Other software · Netskope · reported by psirt@netskope.comHigh 7
The Netskope client service running with NT\SYSTEM privileges accepts network connections from localhost to start various services and execute commands. The connection handling function of Netskope client before R100 in this service utilized a relative path to download and unzip configuration files on the machine. This relative path provided a way for local users to write arbitrary files at a location which is accessible to only higher privileged users. This can be exploited by local users to execute code with NT\SYSTEM privileges on the end machine.
- Product
- Netskope Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetskope.comnetskope.com
Nov 3, 2022Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be resCVE-2021-44862 · Other software · Netskope · reported by psirt@netskope.comHigh 8.4
Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before writing in the logs. A malicious user can use the sensitive information to download data and impersonate another user.
- Product
- NSClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetskope.comnetskope.com
Jan 4, 2022Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability.CVE-2021-41388 · Other software · Netskope · reported by MITREHigh 7.8
Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not perform validation on new connections before accepting the connection. Thus any low privileged user can connect and call external methods defined in XPC service as root, elevating their privilege to the highest level.
- Product
- Netskope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetskope.comnetskope.com
Aug 12, 2021Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM.CVE-2020-24576 · Other software · Netskope · reported by MITREHigh 8.8
Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM.
- Product
- Netskope
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetskope.comnetskope.com
Sep 26, 2019The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost.CVE-2019-12091 · Other software · Netskope · reported by cert@airbus.comHigh 7.8
The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from command injection vulnerability. Local users can use this vulnerability to execute code with NT\SYSTEM privilege.
- Product
- Netskope client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordairbus-seclab.github.iosupport.netskope.com
Sep 26, 2019The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost.CVE-2019-10882 · Other software · Netskope · reported by cert@airbus.comHigh 7.8
The Netskope client service, v57 before 57.2.0.219 and v60 before 60.2.0.214, running with NT\SYSTEM privilege, accepts network connections from localhost. The connection handling function in this service suffers from a stack based buffer overflow in "doHandshakefromServer" function. Local users can use this vulnerability to trigger a crash of the service and potentially cause additional impact on the system.
- Product
- Netskope client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordairbus-seclab.github.iosupport.netskope.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.