Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Sep 12, 2026A flaw has been found in IOBit Uninstaller 15.5.0.11.CVE-2026-90485 · Other software · IOBit · reported by VulDBMedium 5.4
A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub_11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been published and may be used. Identical IURegistryFilter.sys ships across multiple IObit families. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Uninstaller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2026The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privCVE-2026-78622 · Other software · Okta · reported by psirt@okta.comMedium 6
The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents.
- Product
- Okta Verify for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026A flaw has been found in IObit Uninstaller 15.5.0.11.CVE-2026-82670 · Other software · IObit · reported by VulDBMedium 4.8
A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUForceDelete.sys of the component IOCTL Handler. Executing a manipulation can lead to improper privilege management. The attack requires local access. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Uninstaller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privilegCVE-2026-12410 · Other software · Gen Digital · reported by security@nortonlifelock.comHigh 7.8
Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's data folder with elevated integrity.
- Product
- CCleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2026A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x.CVE-2026-12193 · Other software · VS Revo · reported by VulDBHigh 7.1
A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x. The affected element is the function IOCtl_Handler in the library RevoDetector.sys of the component IOCTL Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 2.7.0 is sufficient to fix this issue. It is recommended to upgrade the affected component.
- Product
- RevoUninstaller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjordanhiggins.blog
May 13, 2026IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local attackers to escalate privileges to SYSTECVE-2020-37223 · Other software · Iobit · reported by VulnCheckHigh 8.5
IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local attackers to escalate privileges to SYSTEM level. Attackers can place a malicious executable named IObit.exe in the C:\Program Files (x86)\IObit directory and restart the service to execute code with SYSTEM privileges.
- Product
- IObit Uninstaller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comiobit.com
Jan 26, 2026IObit Uninstaller 10 Pro contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges.CVE-2020-36952 · Other software · Iobit · reported by VulnCheckHigh 8.5
IObit Uninstaller 10 Pro contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted service path in the IObit Uninstaller Service to insert malicious code that would execute with SYSTEM-level permissions during service startup.
- Product
- IObit Uninstaller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comiobit.com
Dec 2, 2025JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM durinCVE-2025-34352 · Other software · JumpCloud Inc. · reported by VulnCheckHigh 8.5
JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM during agent uninstall or update operations. The Remote Assist uninstaller performs privileged create, write, execute, and delete actions on predictable files inside a user-writable %TEMP% subdirectory without validating that the directory is trusted or resetting its ACLs when it already exists. A local, low-privileged attacker can pre-create the directory with weak permissions and leverage mount-point or symbolic-link redirection to (a) coerce arbitrary file writes to protected locations, leading to denial of service (e.g., by overwriting sensitive system files), or (b) win a race to redirect DeleteFileW() to attacker-chosen targets, enabling arbitrary file or folder deletion and local privilege escalation to SYSTEM. This issue is fixed in JumpCloud Remote Assist 0.317.0 and affects Windows systems where Remote Assist is installed and managed through the Agent lifecycle.
- Product
- Remote Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjumpcloud.comjumpcloud.com
Sep 4, 2025In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check.CVE-2025-0087 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.1
In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Feb 11, 2025A vulnerability in the uninstaller component of Cisco AnyConnect Secure Mobility Client for Mac OS could allow an authenticated, local attacker to corrupt the cCVE-2020-3432 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.6
A vulnerability in the uninstaller component of Cisco AnyConnect Secure Mobility Client for Mac OS could allow an authenticated, local attacker to corrupt the content of any file in the filesystem. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a symbolic link (symlink) to a target file on a specific path. A successful exploit could allow the attacker to corrupt the contents of the file. If the file is a critical systems file, the exploit could lead to a denial of service condition. To exploit this vulnerability, the attacker would need to have valid credentials on the system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Product
- Cisco Secure Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
May 16, 2024Uncontrolled search path in some Intel(R) DSA software uninstallers before version 23.4.39.10 may allow an authenticated user to potentially enable escalation oCVE-2023-45743 · Other software · intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path in some Intel(R) DSA software uninstallers before version 23.4.39.10 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- dsa_software_uninstallers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2023A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the CVE-2023-6253 · Other software · Fortra · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfMedium 6
A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the software by extracting the uninstaller key from the memory of the uninstaller file.
- Product
- Digital Guardian Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 23, 2023Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged CVE-2021-26736 · Other software · Zscaler · reported by cve@zscaler.comMedium 6.7
Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges.
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.zscaler.comhelp.zscaler.com
Jul 3, 2023Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.CVE-2023-37378 · Other software · Nullsoft · reported by MITREMedium 5.3
Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.
- Product
- Nullsoft Scriptable Install System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022A DLL hijacking vulnerability exists in the uninstaller in Scooter Beyond Compare 1.8a through 4.4.2 before 4.4.3 when installed via the EXE installer.CVE-2022-36415 · Other software · Scootersoftware · reported by MITREHigh 7.8
A DLL hijacking vulnerability exists in the uninstaller in Scooter Beyond Compare 1.8a through 4.4.2 before 4.4.3 when installed via the EXE installer. The uninstaller attempts to load DLLs out of a Windows Temp folder. If a standard user places malicious DLLs in the C:\Windows\Temp\ folder, and then the uninstaller is run as SYSTEM, the DLLs will execute with elevated privileges.
- Product
- Beyond Compare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordscootersoftware.comscootersoftware.com
Apr 12, 2022GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.CVE-2022-24767 · Computers, phones & browsers · Microsoft · reported by GitHubHigh 7.8
GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Oct 29, 2021On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not CVE-2021-22038 · Other software · VMware · reported by security@vmware.comHigh 8.8
On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exits, so it does not block the installation directory). This temporary location is not randomized and does not restrict access to Administrators only so a potential attacker could plant a binary to replace the copied binary right before it gets called, thus gaining Administrator privileges (if the original uninstaller was executed as Administrator). The vulnerability only affects Windows installers.
- Product
- Installbuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.installbuilder.comblog.installbuilder.com
Feb 10, 2021In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack.CVE-2021-0314 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-171221302
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 15, 2020Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 UpdCVE-2020-7275 · Other software · McAfee LLC · reported by trellixpsirt@trellix.comMedium 4.8
Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to execute arbitrary code via a carefully crafted input file.
- Product
- McAfee Endpoint Security (ENS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.mcafee.comkc.mcafee.com
May 9, 2019GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller with a malicious version, which could allow an attacCVE-2019-6566 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 7.8
GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller with a malicious version, which could allow an attacker to gain administrator privileges to the system.
- Product
- GE Communicator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Dec 5, 2012IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime EnvironCVE-2012-3317 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.9
IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment (JRE) files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300.
- Product
- Websphere Message Broker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2009Unspecified vulnerability in the update feature in Toolbar Uninstaller 1.0.2 allows remote attackers to force the download and execution of arbitrary files via CVE-2009-2963 · Other software · Decomputeur · reported by MITREHigh 9.3
Unspecified vulnerability in the update feature in Toolbar Uninstaller 1.0.2 allows remote attackers to force the download and execution of arbitrary files via attack vectors related to a "malformed update url and a malformed update website."
- Product
- Toolbar Uninstaller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comdecomputeur.nl
Nov 28, 2006CRYPTOCard CRYPTO-Server before 6.4.56 stores LDAP credentials in plaintext in UninstallerData\installvariables.properties, which has insecure permissions and aCVE-2006-6145 · Other software · Cryptocard · reported by MITRELow 2.1
CRYPTOCard CRYPTO-Server before 6.4.56 stores LDAP credentials in plaintext in UninstallerData\installvariables.properties, which has insecure permissions and allows local users to obtain the credentials. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Crypto-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.