Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 76

Export CSV
CVE-2026-50227

MQTT WebSocket Command Execution Vulnerability in NitroSense

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Acer
Products
Nitrosense V5
CVE-2026-50228

Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Acer
Products
Nitrosense V5
CVE-2026-50605

Privilege Escalation Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Acer
Products
Agent Service
CVE-2026-50604

Unauthenticated Access Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be established, potentially allowing access to functionality that should be restricted.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Acer
Products
Agent Service
CVE-2026-50606

Hard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Acer
Products
System Monitoring
CVE-2026-50607

WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Acer
Products
System Monitoring
CVE-2026-50608

Authentication Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service functionality may be possible.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Acer
Products
System Monitoring
CVE-2026-50609

Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Acer
Products
System Monitoring
CVE-2026-50610

Improper Access control Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able to access the service and perform unauthorized registry modifications, potentially resulting in local privilege escalation.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Acer
Products
System Monitoring
CVE-2026-50603

Hard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSense

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Acer
Products
Agent Service
CVE-2026-50602

Planet9 Incorrect Permission Assignment Vulnerability Information

A security vulnerability has been identified in Planet9 due to incorrect file permissions assigned to an application executable used by the Planet9 background service. The service runs with SYSTEM privileges, while the affected executable grants excessive permissions to non-administrative users. As a result, an authenticated local user could potentially modify or replace the executable and execute arbitrary code with SYSTEM privileges when the service starts or the system is restarted.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Acer
Products
Planet9 Background Service
CVE-2026-50601

Planet9 Hardcoded Credentials Vulnerability Information

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain administrative access to repository infrastructure and modify software source code. To mitigate this security risk, Acer has released an update to resolve the issue.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Acer
Products
Planet9 Desktop Application
CVE-2026-8069

PredatorSense V3: Local Privilege Escalation (LPE) vulnerability

PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Acer
Products
Nitrosense Predatorsense Predatorsense V3
CVE-2026-49201

Acer Wave 7 router: Hardcoded Cryptographic Key

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows an attacker to decrypt, modify, and re-encrypt system backups, facilitating persistent backdoor injection.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Acer
Products
Wave 7 Wave 7 Firmware Wave 7 Router