Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
34 results
Sep 17, 2026A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense.CVE-2026-50605 · Other software · Acer · reported by 8fc372e3-d9c5-46e4-9410-38469745c639High 7.4
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.
- Product
- Agent Serivce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense.CVE-2026-50604 · Other software · Acer · reported by 8fc372e3-d9c5-46e4-9410-38469745c639Medium 4.9
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be established, potentially allowing access to functionality that should be restricted.
- Product
- Agent Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense.CVE-2026-50603 · Other software · Acer · reported by 8fc372e3-d9c5-46e4-9410-38469745c639Medium 4.9
A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.
- Product
- Agent Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.CVE-2026-18125 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75High 7.5
An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2026Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection.CVE-2026-44101 · Other software · Phoenix Contact · reported by info@cert.vde.comCritical 9.3
Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and confidential data being disclosed to the attacker.
- Product
- CHARX SEC-3150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability.CVE-2026-28264 · Other software · Dell · reported by security_alert@emc.comLow 3.3
Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
- Product
- PowerProtect Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service.CVE-2023-53949 · Other software · Aspemail · reported by VulnCheckHigh 8.5
AspEmail 5.6.0.2 contains a binary permission vulnerability that allows local users to escalate privileges through the Persits Software EmailAgent service. Attackers can exploit full write permissions in the BIN directory to replace the service executable and gain elevated system access.
- Product
- AspEmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaspemail.comexploit-db.com
Nov 5, 2024Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.CVE-2023-29121 · Other software · Enel X · reported by cve@asrg.ioCritical 9.6
Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.
- Product
- JuiceBox Pro 3.0 22kW Cellular
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport-emobility.enelx.com
Sep 7, 2024A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where tCVE-2024-42024 · Other software · Veeam · reported by support@hackerone.comHigh 8.8
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed.
- Product
- One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2024An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service.CVE-2024-25999 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 8.4
An unauthenticated local attacker can perform a privilege escalation due to improper input validation in the OCPP agent service.
- Product
- CHARX SEC-3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Mar 29, 2023A flaw was found in the QEMU Guest Agent service for Windows.CVE-2023-0664 · Other software · Qemu · reported by Red HatHigh 7.8
A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgitlab.com
Feb 13, 2023An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submiCVE-2023-24523 · Network & remote access · SAP · reported by cna@sap.comHigh 8.8
An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted ConfigureOutsideDiscovery request with an operating system command which will be executed with administrator privileges. The OS command can read or modify any user or system data and can make the system unavailable.
- Product
- Host Agent Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 15, 2022Microsoft File Server Shadow Copy Agent Service (RVSS) Elevation of Privilege VulnerabilityCVE-2022-30154 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Microsoft File Server Shadow Copy Agent Service (RVSS) Elevation of Privilege Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Apr 30, 2021A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery CVE-2020-1721 · Other software · Dogtagpki · reported by Red HatMedium 6.1
A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
- Product
- Dogtagpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Oct 16, 2020The DHCPv6 Relay-Agent service, part of the Juniper Enhanced jdhcpd daemon shipped with Juniper Networks Junos OS has an Improper Input Validation vulnerabilityCVE-2020-1656 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.8
The DHCPv6 Relay-Agent service, part of the Juniper Enhanced jdhcpd daemon shipped with Juniper Networks Junos OS has an Improper Input Validation vulnerability which will result in a Denial of Service (DoS) condition when a DHCPv6 client sends a specific DHPCv6 message allowing an attacker to potentially perform a Remote Code Execution (RCE) attack on the target device. Continuous receipt of the specific DHCPv6 client message will result in an extended Denial of Service (DoS) condition. If adjacent devices are also configured to relay DHCP packets, and are not affected by this issue and simply transparently forward unprocessed client DHCPv6 messages, then the attack vector can be a Network-based attack, instead of an Adjacent-device attack. No other DHCP services are affected. Receipt of the packet without configuration of the DHCPv6 Relay-Agent service, will not result in exploitability of this issue. This issue affects Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S15; 12.3X48 versions prior to 12.3X48-D95; 14.1X53 versions prior to 14.1X53-D53; 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D200; 15.1X53 versions prior to 15.1X53-D593; 16.1 vers
- Product
- Junos OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.juniper.netjuniper.net
Mar 20, 2020A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request searcCVE-2019-10179 · Other software · [UNKNOWN] · reported by Red HatMedium 4.3
A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
- Product
- pki-core/pki-kra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 18, 2020A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizCVE-2019-10146 · Other software · Red Hat · reported by Red HatMedium 4.7
A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser.
- Product
- pki-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jan 23, 2020In IXP EasyInstall 6.2.13723, there is Remote Code Execution via the Agent Service.CVE-2019-19897 · Other software · Ixpdata · reported by MITRECritical 9.8
In IXP EasyInstall 6.2.13723, there is Remote Code Execution via the Agent Service. An unauthenticated attacker can communicate with the Agent Service over TCP port 20051, and execute code in the NT AUTHORITY\SYSTEM context of the target system by using the Execute Command Line function.
- Product
- Easyinstall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordimprosec.comimprosec.com
Jan 23, 2020In IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other users on a client system.CVE-2019-19895 · Other software · Ixpdata · reported by MITREHigh 7.8
In IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other users on a client system. An authenticated attacker can, by modifying %SYSTEMDRIVE%\IXP\SW\[PACKAGE_CODE]\EveryLogon.bat, achieve this movement and execute code in the context of other users.
- Product
- Easyinstall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordimprosec.comimprosec.com
Jan 23, 2020In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system.CVE-2019-19894 · Other software · Ixpdata · reported by MITREMedium 5.5
In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. An authenticated attacker (non-admin) can disable UAC for other users by renaming and replacing %SYSTEMDRIVE%\IXP\DATA\IXPAS.IXP.
- Product
- Easyinstall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordimprosec.comimprosec.com
Jan 13, 2020A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain CVE-2012-4760 · Other software · Safend · reported by MITREHigh 7.8
A Privilege Escalation vulnerability exists in the SDBagent service in Safend Data Protector Agent 3.4.5586.9772, which could let a local malicious user obtain privileges.
- Product
- Data Protector Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.compacketstormsecurity.com
Jul 26, 2014The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN flood, aka Bug ID CSCun3CVE-2014-3328 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5
The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN flood, aka Bug ID CSCun34125.
- Product
- Unified Presence Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comsecurityfocus.com
Oct 1, 2013Unquoted Windows search path vulnerability in the QEMU Guest Agent service for Red Hat Enterprise Linux Desktop 6, HPC Node 6, Server 6, Workstation 6, Desktop CVE-2013-2231 · Other software · Redhat · reported by Red HatHigh 7.2
Unquoted Windows search path vulnerability in the QEMU Guest Agent service for Red Hat Enterprise Linux Desktop 6, HPC Node 6, Server 6, Workstation 6, Desktop Supplementary 6, Server Supplementary 6, Supplementary AUS 6.4, Supplementary EUS 6.4.z, and Workstation Supplementary 6, when installing on Windows, allows local users to gain privileges via a crafted program in an unspecified folder.
- Product
- Enterprise Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrhn.redhat.comrhn.redhat.com
Dec 5, 2011The Agent service in Iron Mountain Connected Backup 8.4 allows remote attackers to execute arbitrary code via a crafted opcode 13 request that triggers use of tCVE-2011-2397 · Other software · Ironmountain · reported by MITREHigh 10
The Agent service in Iron Mountain Connected Backup 8.4 allows remote attackers to execute arbitrary code via a crafted opcode 13 request that triggers use of the LaunchCompoundFileAnalyzer class to send request data to the System.getRunTime.exec method.
- Product
- Connected Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgzerodayinitiative.com
Feb 10, 2011Stack-based buffer overflow in BMC PATROL Agent Service Daemon for in Performance Analysis for Servers, Performance Assurance for Servers, and Performance AssurCVE-2011-0975 · Other software · BMC · reported by MITREHigh 10
Stack-based buffer overflow in BMC PATROL Agent Service Daemon for in Performance Analysis for Servers, Performance Assurance for Servers, and Performance Assurance for Virtual Servers 7.4.00 through 7.5.10; Performance Analyzer and Performance Predictor for Servers 7.4.00 through 7.5.10; and Capacity Management Essentials 1.2.00 (7.4.15) allows remote attackers to execute arbitrary code via a crafted length value in a BGS_MULTIPLE_READS command to TCP port 6768.
- Product
- Performance Analysis For Servers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2009Directory traversal vulnerability in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, possibly 5.40 SP1 and CVE-2008-3685 · Other software · EMC · reported by MITREHigh 10
Directory traversal vulnerability in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, possibly 5.40 SP1 and earlier, allows remote attackers to upload arbitrary files, and execute arbitrary code, via directory traversal sequences in requests to TCP port 2606.
- Product
- Documentum Applicationxtender Workflow Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comzerodayinitiative.com
Oct 22, 2009Heap-based buffer overflow in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, possibly 5.40 SP1 and earlierCVE-2008-3684 · Other software · EMC · reported by MITREHigh 10
Heap-based buffer overflow in aws_tmxn.exe in the Admin Agent service in the server in EMC Documentum ApplicationXtender Workflow, possibly 5.40 SP1 and earlier, allows remote attackers to execute arbitrary code via crafted packet data to TCP port 2606.
- Product
- Documentum Applicationxtender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comzerodayinitiative.com
May 5, 2009Multiple stack-based buffer overflows in dsmagent.exe in the Remote Agent Service in the IBM Tivoli Storage Manager (TSM) client 5.1.0.0 through 5.1.8.2, 5.2.0.CVE-2008-4828 · Other software · IBM · reported by PSIRT-CNA@flexerasoftware.comHigh 10
Multiple stack-based buffer overflows in dsmagent.exe in the Remote Agent Service in the IBM Tivoli Storage Manager (TSM) client 5.1.0.0 through 5.1.8.2, 5.2.0.0 through 5.2.5.3, 5.3.0.0 through 5.3.6.4, and 5.4.0.0 through 5.4.1.96, and the TSM Express client 5.3.3.0 through 5.3.6.4, allow remote attackers to execute arbitrary code via (1) a request packet that is not properly parsed by an unspecified "generic string handling function" or (2) a crafted NodeName in a dicuGetIdentifyRequest request packet, related to the (a) Web GUI and (b) Java GUI.
- Product
- Tivoli Storage Manager Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2008The SAN Manager Master Agent service (aka msragent.exe) in EMC Control Center before 6.1 does not properly authenticate SST_SENDFILE requests, which allows remoCVE-2008-5420 · Other software · EMC · reported by MITREHigh 7.8
The SAN Manager Master Agent service (aka msragent.exe) in EMC Control Center before 6.1 does not properly authenticate SST_SENDFILE requests, which allows remote attackers to read arbitrary files.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2008Stack-based buffer overflow in SAN Manager Master Agent service (aka msragent.exe) in EMC Control Center 5.2 SP5 and 6.0 allows remote attackers to execute arbiCVE-2008-5419 · Other software · EMC · reported by MITREHigh 10
Stack-based buffer overflow in SAN Manager Master Agent service (aka msragent.exe) in EMC Control Center 5.2 SP5 and 6.0 allows remote attackers to execute arbitrary code via multiple SST_CTGTRANS requests.
- Product
- Control Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2008The SNMP Trap Agent service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), andCVE-2008-1746 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
The SNMP Trap Agent service in Cisco Unified Communications Manager (CUCM) 4.1 before 4.1(3)SR6, 4.2 before 4.2(3)SR3, 4.3 before 4.3(2), 5.x before 5.1(3), and 6.x before 6.1(1) allows remote attackers to cause a denial of service (core dump and service restart) via a series of malformed UDP packets, as demonstrated by the IP Stack Integrity Checker (ISIC), aka Bug ID CSCsj24113.
- Product
- Unified Communications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecuritytracker.com
May 23, 2007Stack-based buffer overflow in the MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan before 9.0.718.1 allows remote attackers to execute aCVE-2007-2687 · Other software · Microworld Technologies · reported by PSIRT-CNA@flexerasoftware.comHigh 10
Stack-based buffer overflow in the MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan before 9.0.718.1 allows remote attackers to execute arbitrary code via a long command.
- Product
- Escan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2007The MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan 8.0.671.1, and possibly other versions, allows remote or local attackers to gain priCVE-2007-0655 · Other software · Microworld Technologies · reported by PSIRT-CNA@flexerasoftware.comHigh 10
The MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan 8.0.671.1, and possibly other versions, allows remote or local attackers to gain privileges and execute arbitrary commands by connecting directly to TCP port 2222.
- Product
- Escan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2002Buffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service oCVE-2002-0053 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
Buffer overflow in SNMP agent service in Windows 95/98/98SE, Windows NT 4.0, Windows 2000, and Windows XP allows remote attackers to cause a denial of service or execute arbitrary code via a malformed management request. NOTE: this candidate may be split or merged with other candidates. This and other PROTOS-related candidates, especially CVE-2002-0012 and CVE-2002-0013, will be updated when more accurate information is available.
- Product
- Windows 2000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcve.mitre.orgcve.mitre.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.