Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

38 results

Oct 28, 2026Local privilege escalation due to improper authentication.CVE-2025-30414 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 42569, Acronis Cyber Protect 17 (Windows) before build 42587.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Mar 5, 2026Default credentials set for local privileged user in Virtual Appliance.CVE-2026-28713 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud Agent (VMware) before build 36943, Acronis Cyber Protect 17 (VMware) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Mar 5, 2026Credentials are not deleted from Acronis Agent after plan revocation.CVE-2025-30413 · Other software · Acronis · reported by security@acronis.comMedium 4.4
Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40497, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Mar 5, 2026Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-11792 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 41124.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Mar 5, 2026Credentials are not deleted from Acronis Agent after plan revocation.CVE-2025-11790 · Other software · Acronis · reported by security@acronis.comMedium 4.4
Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Feb 19, 2026Sensitive data disclosure and manipulation due to missing authentication.CVE-2025-30410 · Other software · Acronis · reported by security@acronis.comCritical 9.8
Sensitive data disclosure and manipulation due to missing authentication. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 39870, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, macOS, Windows) before build 41800.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Aug 28, 2025Local privilege escalation due to insecure folder permissions.CVE-2025-9578 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40734.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Aug 28, 2025Local privilege escalation due to improper soft link handling.CVE-2025-48963 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40296.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jun 4, 2025Local privilege escalation due to insecure file permissions.CVE-2025-48959 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 40077.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jun 4, 2025Denial of service due to improper handling of malformed input.CVE-2025-30415 · Other software · Acronis · reported by security@acronis.comHigh 7.5
Denial of service due to improper handling of malformed input. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 40077, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Apr 24, 2025Denial of service due to allocation of resources without limits.CVE-2025-30409 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Denial of service due to allocation of resources without limits. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 17 (Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Apr 24, 2025Local privilege escalation due to insecure folder permissions.CVE-2025-30408 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39904, Acronis Cyber Protect 16 (Windows) before build 39938.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Mar 26, 2025Local privilege escalation due to a binary hijacking vulnerability.CVE-2025-30407 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39713.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to unquoted search path vulnerability.CVE-2025-24831 · Other software · Acronis · reported by security@acronis.comMedium 6.6
Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24830 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24829 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24828 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Jan 31, 2025Local privilege escalation due to DLL hijacking vulnerability.CVE-2025-24827 · Other software · Acronis · reported by security@acronis.comMedium 6.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 39378.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Dec 23, 2024Weak algorithm used to sign RPM package.CVE-2024-55539 · Other software · Acronis · reported by security@acronis.comLow 2.5
Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux) before build 39185, Acronis Cyber Protect 16 (Linux) before build 39938.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 23, 2024Local active protection service settings manipulation due to unnecessary privileges assignment.CVE-2024-8903 · Other software · Acronis · reported by security@acronis.comMedium 4.7
Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows, macOS) before build 38565.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 16, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-8766 · Other software · Acronis · reported by security@acronis.comMedium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38235, Acronis Cyber Protect 16 (Windows) before build 39169.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Sep 16, 2024Local privilege escalation due to DLL hijacking vulnerability.CVE-2024-34016 · Other software · Acronis · reported by security@acronis.comMedium 6.5
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 38235.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com
Apr 29, 2024Local privilege escalation due to insecure folder permissions.CVE-2024-34011 · Other software · Acronis · reported by security@acronis.comMedium 6.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 37758.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 29, 2024Local privilege escalation due to unquoted search path vulnerability.CVE-2024-34010 · Other software · Acronis · reported by security@acronis.comHigh 8.2
Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 37758, Acronis Cyber Protect 16 (Windows) before build 38690, Acronis True Image (Windows) before build 42386, Acronis True Image OEM (Windows) before build 42575.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 29, 2024Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-48684 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 37758, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Apr 29, 2024Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-48683 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 37758, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Dec 14, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-48676 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36943.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 9, 2023Local privilege escalation due to DLL hijacking vulnerability.CVE-2023-45248 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36497, Acronis Cyber Protect 16 (Windows) before build 37391.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 9, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-45247 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36497, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 6, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-45246 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36343, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 39169.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 6, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-45244 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35895, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 37391.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 5, 2023Sensitive information disclosure due to missing authorization.CVE-2023-45243 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 5, 2023Sensitive information disclosure due to missing authorization.CVE-2023-45242 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 5, 2023Sensitive information leak through log files.CVE-2023-45241 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 37391.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 5, 2023Sensitive information disclosure due to excessive collection of system information.CVE-2023-44213 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to excessive collection of system information. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 35739, Acronis Cyber Protect 16 (Windows) before build 37391.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 5, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-44211 · Other software · Acronis · reported by security@acronis.comHigh 7.1
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 31637, Acronis Cyber Protect 16 (Linux, Windows) before build 37391.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 4, 2023Sensitive information disclosure and manipulation due to missing authorization.CVE-2023-44210 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 29258, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com
Oct 4, 2023Local privilege escalation due to improper soft link handling.CVE-2023-44209 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 29051, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186.
Product
Acronis Cyber Protect Cloud Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-advisory.acronis.com security-advisory.acronis.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.