ESET

Latest CVEs · RSS

• CVE-2025-8352 2026-10-06 · CVSS 6.9
  Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions f
• CVE-2026-12858 2026-09-09 · CVSS 8.5
  Improper Privilege Management vulnerability in ESET AV Remover (standalone) allows Privilege Escalation via especially crafted RPC.
• CVE-2026-10610 2026-07-24 · CVSS 8.5
  Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user.
• CVE-2026-7483 2026-07-24 · CVSS 8.5
  Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user.
• CVE-2026-6424 2026-07-16 · CVSS 6.7
  Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system
• CVE-2026-6423 2026-07-16 · CVSS 8.5
  A local privilege escalation vulnerability in ESET Inspect Connector.  The vulnerability was caused by improper authentication in an IPC channel.
• CVE-2025-3716 2026-03-30 · CVSS 5.3
  User enumeration in ESET Protect (on-prem) via Response Timing.
• CVE-2025-13818 2026-02-06 · CVSS 8.3
  Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent
• CVE-2025-13176 2026-01-30 · CVSS 8.4
  Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL.
• CVE-2025-12460 2025-10-31 · CVSS 5.3
  An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript i
• CVE-2025-4952 2025-10-31 · CVSS 6.8
  Tampering of the registry entries might have led to preventing the ESET security products from starting correctly on the next system startup or to unauthorized
• CVE-2025-8088 2025-08-08 · CVSS 8.4
  A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This
• CVE-2025-2425 2025-07-18 · CVSS 5.1
  Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of an
• CVE-2025-5028 2025-07-11 · CVSS 6.8
  Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without having the permissions to do so.
• CVE-2025-3929 2025-04-29 · CVSS 5.3
  An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an
• CVE-2024-11859 2025-04-07 · CVSS 8.4
  DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its
• CVE-2025-2516 2025-03-27 · CVSS 9.5
  The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered
• CVE-2024-11957 2025-03-04 · CVSS 9.3
  Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attack
• CVE-2024-11182 2024-11-15 · CVSS 5.3
  An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This
• CVE-2024-6654 2024-09-27 · CVSS 6.8
  Products for macOS enables a user logged on to the system to perform a denial-of-service attack, which could be misused to disable the protection of the ESET se
• CVE-2024-7400 2024-09-27 · CVSS 8.5
  The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to dele
• CVE-2024-7263 2024-08-15 · CVSS 9.3
  Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an att
• CVE-2024-7262 2024-08-15 · CVSS 9.3
  Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an att
• CVE-2024-7014 2024-07-23 · CVSS 7.1
  EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.
• CVE-2024-3779 2024-07-16 · CVSS 6.1
  Denial of service vulnerability present shortly after product installation or upgrade, potentially allowed an attacker to render ESET’s security product inopera