https://vulnogram.org/ Most recent CVEs assigned by ESET, spol. s r.o. (eset). https://vulnogram.org/seaview/icons/eset.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2025-8352 https://vulnogram.org/CVE-2025-8352 Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions for a Denial-of-Service attack. Medium Network Exploitable Tue, 06 Oct 2026 14:50:55 GMT https://vulnogram.org/CVE-2026-12858 https://vulnogram.org/CVE-2026-12858 Improper Privilege Management vulnerability in ESET AV Remover (standalone) allows Privilege Escalation via especially crafted RPC. High Wed, 09 Sep 2026 08:29:18 GMT https://vulnogram.org/CVE-2026-10610 https://vulnogram.org/CVE-2026-10610 Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user. High Fri, 24 Jul 2026 11:14:51 GMT https://vulnogram.org/CVE-2026-7483 https://vulnogram.org/CVE-2026-7483 Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user. High Fri, 24 Jul 2026 09:40:04 GMT https://vulnogram.org/CVE-2026-6424 https://vulnogram.org/CVE-2026-6424 Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system Medium Thu, 16 Jul 2026 08:28:43 GMT https://vulnogram.org/CVE-2026-6423 https://vulnogram.org/CVE-2026-6423 A local privilege escalation vulnerability in ESET Inspect Connector. The vulnerability was caused by improper authentication in an IPC channel. High Thu, 16 Jul 2026 07:56:20 GMT https://vulnogram.org/CVE-2025-3716 https://vulnogram.org/CVE-2025-3716 User enumeration in ESET Protect (on-prem) via Response Timing. Medium Mon, 30 Mar 2026 07:30:30 GMT https://vulnogram.org/CVE-2025-13818 https://vulnogram.org/CVE-2025-13818 Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent High Fri, 06 Feb 2026 13:13:47 GMT https://vulnogram.org/CVE-2025-13176 https://vulnogram.org/CVE-2025-13176 Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL. High Fri, 30 Jan 2026 12:18:58 GMT https://vulnogram.org/CVE-2025-12460 https://vulnogram.org/CVE-2025-12460 An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img HTML tag. This could allow a remote attacker to load arbitrary JavaScript code in… Medium Network Exploitable Fri, 31 Oct 2025 13:53:58 GMT https://vulnogram.org/CVE-2025-4952 https://vulnogram.org/CVE-2025-4952 Tampering of the registry entries might have led to preventing the ESET security products from starting correctly on the next system startup or to unauthorized changes in the product's configuration. Medium Fri, 31 Oct 2025 12:28:15 GMT https://vulnogram.org/CVE-2025-8088 https://vulnogram.org/CVE-2025-8088 A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Koši… High Known Exploited Fri, 08 Aug 2025 11:11:41 GMT https://vulnogram.org/CVE-2025-2425 https://vulnogram.org/CVE-2025-2425 Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of an arbitrary file on the file system. Medium Fri, 18 Jul 2025 09:20:52 GMT https://vulnogram.org/CVE-2025-5028 https://vulnogram.org/CVE-2025-5028 Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without having the permissions to do so. Medium Fri, 11 Jul 2025 06:40:28 GMT https://vulnogram.org/CVE-2025-3929 https://vulnogram.org/CVE-2025-3929 An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the cont… Medium Network Exploitable Tue, 29 Apr 2025 11:36:33 GMT https://vulnogram.org/CVE-2024-11859 https://vulnogram.org/CVE-2024-11859 DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its code. High Mon, 07 Apr 2025 08:08:22 GMT https://vulnogram.org/CVE-2025-2516 https://vulnogram.org/CVE-2025-2516 The use of a weak cryptographic key pair in the signature verification process in WPS Office (Kingsoft) on Windows allows an attacker who successfully recovered the private key to sign components. As older versions of WPS Office did not validate the… Critical Network Exploitable Thu, 27 Mar 2025 14:29:22 GMT https://vulnogram.org/CVE-2024-11957 https://vulnogram.org/CVE-2024-11957 Improper verification of the digital signature in ksojscore.dll in Kingsoft WPS Office in versions equal or less than 12.1.0.18276 on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.2.0.16909 to mitig… Critical Tue, 04 Mar 2025 15:41:00 GMT https://vulnogram.org/CVE-2024-11182 https://vulnogram.org/CVE-2024-11182 An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail us… Medium Known Exploited Network Exploitable Fri, 15 Nov 2024 10:43:10 GMT https://vulnogram.org/CVE-2024-6654 https://vulnogram.org/CVE-2024-6654 Products for macOS enables a user logged on to the system to perform a denial-of-service attack, which could be misused to disable the protection of the ESET security product and cause general system slow-down. Medium Fri, 27 Sep 2024 08:54:28 GMT https://vulnogram.org/CVE-2024-7400 https://vulnogram.org/CVE-2024-7400 The vulnerability potentially allowed an attacker to misuse ESET’s file operations during the removal of a detected file on the Windows operating system to delete files without having proper permissions to do so. High Fri, 27 Sep 2024 07:02:28 GMT https://vulnogram.org/CVE-2024-7263 https://vulnogram.org/CVE-2024-7263 Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.1.0.17119 to… Critical Thu, 15 Aug 2024 14:29:04 GMT https://vulnogram.org/CVE-2024-7262 https://vulnogram.org/CVE-2024-7262 Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a si… Critical Known Exploited Thu, 15 Aug 2024 14:24:44 GMT https://vulnogram.org/CVE-2024-7014 https://vulnogram.org/CVE-2024-7014 EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older. High Tue, 23 Jul 2024 09:55:42 GMT https://vulnogram.org/CVE-2024-3779 https://vulnogram.org/CVE-2024-3779 Denial of service vulnerability present shortly after product installation or upgrade, potentially allowed an attacker to render ESET’s security product inoperable, provided non-default preconditions were met. Medium Tue, 16 Jul 2024 08:17:59 GMT https://vulnogram.org/CVE-2024-2003 https://vulnogram.org/CVE-2024-2003 Local privilege escalation vulnerability allowed an attacker to misuse ESET's file operations during a restore operation from quarantine. High Fri, 21 Jun 2024 07:20:03 GMT https://vulnogram.org/CVE-2024-0353 https://vulnogram.org/CVE-2024-0353 Local privilege escalation vulnerability potentially allowed an attacker to misuse ESET’s file operations to delete files without having proper permission. High Thu, 15 Feb 2024 07:40:24 GMT https://vulnogram.org/CVE-2023-7043 https://vulnogram.org/CVE-2023-7043 Unquoted service path in ESET products allows to drop a prepared program to a specific location and run on boot with the NT AUTHORITY\NetworkService permissions. Low Wed, 31 Jan 2024 12:51:38 GMT https://vulnogram.org/CVE-2023-5594 https://vulnogram.org/CVE-2023-5594 Improper validation of the server’s certificate chain in secure traffic scanning feature considered intermediate certificate signed using the MD5 or SHA1 algorithm as trusted. High Network Exploitable Thu, 21 Dec 2023 11:30:41 GMT https://vulnogram.org/CVE-2023-5631 https://vulnogram.org/CVE-2023-5631 Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbit… Medium Known Exploited Network Exploitable Wed, 18 Oct 2023 14:51:18 GMT https://vulnogram.org/CVE-2023-3160 https://vulnogram.org/CVE-2023-3160 The vulnerability potentially allows an attacker to misuse ESET’s file operations during the module update to delete or move files without having proper permissions. High Mon, 14 Aug 2023 09:27:02 GMT https://vulnogram.org/CVE-2023-2847 https://vulnogram.org/CVE-2023-2847 During internal security analysis, a local privilege escalation vulnerability has been identified. On a machine with the affected ESET product installed, it was possible for a user with lower privileges due to improper privilege management to trigger… High Thu, 15 Jun 2023 07:46:47 GMT https://vulnogram.org/CVE-2022-4020 https://vulnogram.org/CVE-2022-4020 Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable. High Mon, 28 Nov 2022 13:00:01 GMT https://vulnogram.org/CVE-2022-2402 https://vulnogram.org/CVE-2022-2402 The vulnerability in the driver dlpfde.sys enables a user logged into the system to perform system calls leading to kernel stack overflow, resulting in a system crash, for instance, a BSOD. Medium Tue, 06 Sep 2022 17:18:51 GMT https://vulnogram.org/CVE-2021-37851 https://vulnogram.org/CVE-2021-37851 Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious code with higher privileges. This issue affects: ESET, spol. s r.o. ESET NOD32 Antivirus 11.2… High Wed, 11 May 2022 14:08:03 GMT https://vulnogram.org/CVE-2022-27167 https://vulnogram.org/CVE-2022-27167 Privilege escalation vulnerability in Windows products of ESET, spol. s r.o. allows attacker to exploit "Repair" and "Uninstall" features what may lead to arbitrary file deletion. This issue affects: ESET, spol. s r.o. ESET NOD32 Antivirus 11.2 versi… High Tue, 10 May 2022 19:43:59 GMT https://vulnogram.org/CVE-2022-0615 https://vulnogram.org/CVE-2022-0615 Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-service condition on the system. Medium Network Exploitable Fri, 25 Feb 2022 18:10:52 GMT https://vulnogram.org/CVE-2021-37852 https://vulnogram.org/CVE-2021-37852 ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attacker to escalate privileges in the context of NT AUTHORITY\SYSTEM. High Wed, 09 Feb 2022 05:14:13 GMT https://vulnogram.org/CVE-2021-37850 https://vulnogram.org/CVE-2021-37850 ESET was made aware of a vulnerability in its consumer and business products for macOS that enables a user logged on to the system to stop the ESET daemon, effectively disabling the protection of the ESET security product until a system reboot. Medium Mon, 08 Nov 2021 13:35:49 GMT