Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24

Export CSV
CVE-2026-27750

Avira Internet Security Optimizer TOCTOU

Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component. A privileged service running as SYSTEM identifies directories for cleanup during a scan phase and subsequently deletes them during a separate cleanup phase without revalidating the target path. A local attacker can replace a previously scanned directory with a junction or reparse point before deletion occurs, causing the privileged process to delete an unintended system location. This may result in deletion of protected files or directories and can lead to local privilege escalation, denial of service, or system integrity compromise depending on the affected target.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Avira Gen Digital
Products
Avira Internet Security Suite Internet Security Avira Internet Security
CVE-2026-27749

Avira Internet Security System Speedup Insecure Deserialization

Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup component. The Avira.SystemSpeedup.RealTimeOptimizer.exe process, which runs with SYSTEM privileges, deserializes data from a file located in C:\\ProgramData using .NET BinaryFormatter without implementing input validation or deserialization safeguards. Because the file can be created or modified by a local user in default configurations, an attacker can supply a crafted serialized payload that is deserialized by the privileged process, resulting in arbitrary code execution as SYSTEM.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Avira Gen Digital
Products
Avira Internet Security Suite Internet Security Avira Internet Security
CVE-2026-27748

Avira Internet Security Arbitrary File Deletion via Improper Link Resolution

Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service running as SYSTEM deletes a file under C:\\ProgramData without validating whether the path resolves through a symbolic link or reparse point. A local attacker can create a malicious link to redirect the delete operation to an arbitrary file, resulting in deletion of attacker-chosen files with SYSTEM privileges. This may lead to local privilege escalation, denial of service, or system integrity compromise depending on the targeted file and operating system configuration.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Avira Gen Digital
Products
Avira Internet Security Suite Internet Security Avira Internet Security
CVE-2025-3025

CCleaner Link Following Local Privilege Escalation Vulnerability

Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploiting insecure file delete operations. Reported in CCleaner v. 6.33.11465. This issue affects CCleaner: before < 6.36.11508.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Gen Digital Microsoft
Products
Ccleaner Windows