yandex

Latest CVEs · RSS

• CVE-2026-10549 2026-06-02 · CVSS 5.3
  LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership checks
• CVE-2025-5469 2025-12-09 · CVSS 7.3
  Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245
• CVE-2025-5471 2025-12-09 · CVSS 7.3
  Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.
• CVE-2025-5470 2025-12-09 · CVSS 7.3
  Uncontrolled Search Path Element vulnerability in Yandex Disk on MacOS allows Search Order Hijacking.This issue affects Disk: before 3.2.45.3275.
• CVE-2024-12168 2025-06-02 · CVSS 8.4
  Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.
• CVE-2023-26226 2025-05-30 · CVSS 7.4
  A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682
• CVE-2019-16536 2025-05-21 · CVSS 8.2
  Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.
• CVE-2021-25262 2025-05-21 · CVSS 6.9
  Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.
• CVE-2021-25255 2025-05-21 · CVSS 8.3
  Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.
• CVE-2021-25254 2025-05-21 · CVSS 8.2
  Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.
• CVE-2024-6473 2024-09-03 · CVSS 8.4
  Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.
• CVE-2022-28229 2022-12-23
  The hash functionality in userver before 42059b6319661583b3080cab9b595d4f8ac48128 allows attackers to cause a denial of service via crafted HTTP request, involv
• CVE-2022-28228 2022-12-23
  Out-of-bounds read was discovered in YDB server. An attacker could construct a query with insert statement that would allow him to read sensitive information fr
• CVE-2022-28225 2022-06-15
  Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYSTE
• CVE-2022-28226 2022-06-15
  Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary code with the SYSTE
• CVE-2021-25261 2022-06-15
  Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary code with the SYSTE
• CVE-2020-27970 2021-09-13
  Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar
• CVE-2020-27969 2021-09-13
  Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing
• CVE-2021-25263 2021-08-17
  Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYSTE
• CVE-2019-15024 2019-12-30
  In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network whe
• CVE-2019-16535 2019-12-30
  In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can be used to achieve RCE or DoS via nativ
• CVE-2018-14672 2019-08-15
  In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.
• CVE-2018-14671 2019-08-15
  In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.
• CVE-2018-14669 2019-08-15
  ClickHouse MySQL client before versions 1.1.54390 had "LOAD DATA LOCAL INFILE" functionality enabled that allowed a malicious MySQL database read arbitrary file
• CVE-2018-14668 2019-08-15
  In ClickHouse before 1.1.54388, "remote" table function allowed arbitrary symbols in "user", "password" and "default_database" fields which led to Cross Protoco