11 CVEs matched to OPSWAT by name in NVD, none on CISA's Known Exploited list.
Back to the OPSWAT profile · Alternatives to OPSWAT · CVE RSS feed
2 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resu…
OPSWAT MetaDefender before v4.11.2 allows CSV injection.
As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate fil…
| Year | Critical | High | Medium | Low | Unscored | Total |
|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 1 | 0 | 0 | 1 |
| 2025 | 0 | 0 | 1 | 0 | 1 | 2 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 |
| 2023 | 2 | 1 | 0 | 0 | 0 | 3 |
| 2022 | 1 | 0 | 2 | 0 | 0 | 3 |
| 2018 | 0 | 1 | 0 | 0 | 0 | 1 |
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.
| CVE | EPSS | Percentile |
|---|---|---|
| CVE-2022-32272 | 9.6% | 95% |
| CVE-2023-36659 | 1.0% | 62% |
| CVE-2018-16275 | 0.9% | 61% |
| CVE-2022-32273 | 0.8% | 55% |
| CVE-2023-36657 | 0.7% | 52% |
| CVE-2022-40778 | 0.5% | 40% |
| CVE-2026-36425 | 0.4% | 32% |
| CVE-2024-52925 | 0.3% | 24% |
| CVE-2023-25364 | 0.3% | 22% |
| CVE-2023-36658 | 0.2% | 13% |
An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege val…
An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non…
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of ser…
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalati…
In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives.
Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks.
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication).
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally.
A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary JavaScript or HTML because of the blocked page response.
OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation.
As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate filenames on the server.
OPSWAT MetaDefender before v4.11.2 allows CSV injection.