Kaspersky
61 CVEs across 54 Kaspersky products. Browse Kaspersky vulnerabilities, severities, and proof-of-concept exploits.
Kaspersky products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64984 | Medium | 6.1 | 2025-11-20 | Kaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux (any version with anti-virus databases prior to 18.11.2025), Kaspersky Industrial… |
CVE-2024-13614 | Medium | 5.3 | 2025-02-06 | Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky Endpoint Security fo… |
CVE-2023-23349 | Low | 2.2 | 2024-03-22 | Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled credentials from a me… |
CVE-2024-1619 | Medium | 6.1 | 2024-02-29 | Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially force an administrat… |
CVE-2022-27535 | High | 7.8 | 2022-08-05 | Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports'… |
CVE-2022-27534 | Critical | 9.8 | 2022-04-01 | Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing modul… |
CVE-2021-27223 | Medium | 5.5 | 2022-04-01 | A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security. A local us… |
CVE-2021-35052 | High | 7.8 | 2021-11-23 | A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High. |
CVE-2021-35053 | High | 7.5 | 2021-11-03 | Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browser parameters file i… |
CVE-2020-27020 | High | 7.5 | 2021-05-14 | Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated p… |
CVE-2021-26718 | Medium | 5.5 | 2021-04-01 | KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection. |
CVE-2020-26200 | Medium | 6.8 | 2021-02-26 | A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorp… |
CVE-2020-36200 | Medium | 6.5 | 2021-01-26 | TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs. |
CVE-2020-36199 | Critical | 9.8 | 2021-01-26 | TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places. |
CVE-2020-35929 | Critical | 9.8 | 2021-01-19 | In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This inf… |
CVE-2020-28950 | High | 7.8 | 2020-12-04 | The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate p… |
CVE-2020-25045 | High | 7.8 | 2020-09-02 | Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack t… |
CVE-2020-25044 | High | 7.1 | 2020-09-02 | Kaspersky Virus Removal Tool (KVRT) prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the opportunity to elimi… |
CVE-2020-25043 | High | 7.1 | 2020-09-02 | The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the… |
CVE-2019-15695 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due… |
CVE-2019-15694 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to th… |
CVE-2019-15693 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could… |
CVE-2019-15692 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Ex… |
CVE-2019-15691 | High | 7.2 | 2019-12-26 | TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routi… |
CVE-2019-15689 | Medium | 6.7 | 2019-12-02 | Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E have bug that allows… |
CVE-2019-15688 | Medium | 6.1 | 2019-11-26 | Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Clo… |
CVE-2019-15687 | Medium | 6.5 | 2019-11-26 | Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Clo… |
CVE-2019-15686 | Medium | 4.3 | 2019-11-26 | Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Clo… |
CVE-2019-15685 | Medium | 4.3 | 2019-11-26 | Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Clo… |
CVE-2019-15684 | Medium | 4.3 | 2019-11-25 | Kaspersky Protection extension for web browser Google Chrome prior to 30.112.62.0 was vulnerable to unauthorized access to its features remotely that could lea… |
CVE-2019-8287 | Critical | 9.8 | 2019-10-29 | TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution. This attack appear… |
CVE-2019-15683 | Critical | 9.8 | 2019-10-29 | TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e. This could possibly result into… |
CVE-2019-15681 | High | 7.5 | 2019-10-29 | LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory… |
CVE-2019-15680 | High | 7.5 | 2019-10-29 | TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploi… |
CVE-2019-15679 | Critical | 9.8 | 2019-10-29 | TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear… |
CVE-2019-15678 | Critical | 9.8 | 2019-10-29 | TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. This attack appear to be… |
CVE-2019-8286 | Medium | 4.3 | 2019-07-18 | Information Disclosure in Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security versions up to 2019 could potentially disclose unique Pro… |
CVE-2019-8285 | High | 8.8 | 2019-05-08 | Kaspersky Lab Antivirus Engine version before 04.apr.2019 has a heap-based buffer overflow vulnerability that potentially allow arbitrary code execution |
CVE-2018-6306 | High | 7.8 | 2018-04-19 | Unauthorized code execution from specific DLL and is known as DLL Hijacking attack in Kaspersky Password Manager versions before 8.0.6.538. |
CVE-2018-6291 | Medium | 6.1 | 2018-02-06 | WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1. |
CVE-2018-6290 | High | 7.8 | 2018-02-06 | Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1. |
CVE-2018-6289 | Critical | 9.8 | 2018-02-06 | Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1. |
CVE-2018-6288 | High | 8.8 | 2018-02-06 | Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1. |
CVE-2017-12823 | High | 7.8 | 2017-12-08 | Kernel pool memory corruption in one of drivers in Kaspersky Embedded Systems Security version 1.2.0.300 leads to local privilege escalation. |
CVE-2017-12817 | High | 7.5 | 2017-08-25 | In Kaspersky Internet Security for Android 11.12.4.1622, some of the application trace files were not encrypted. |
CVE-2017-12816 | Critical | 9.8 | 2017-08-25 | In Kaspersky Internet Security for Android 11.12.4.1622, some of application exports activities have weak permissions, which might be used by a malware applica… |
CVE-2017-9813 | Medium | 6.1 | 2017-07-17 | In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the licenseKeyInfo acti… |
CVE-2017-9812 | High | 7.5 | 2017-07-17 | The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance… |
CVE-2017-9811 | Critical | 9.8 | 2017-07-17 | The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8… |
CVE-2017-9810 | High | 8.8 | 2017-07-17 | There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version… |
CVE-2016-4329 | Medium | 5.5 | 2017-01-06 | A local denial of service vulnerability exists in window broadcast message handling functionality of Kaspersky Anti-Virus software. Sending certain unhandled w… |
CVE-2016-4307 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the IOCTL handling functionality of Kaspersky Internet Security KL1 driver. A specially crafted IOCTL signal can ca… |
CVE-2016-4306 | Medium | 5.5 | 2017-01-06 | Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver. Specially crafted IOCTL requests can cause the dri… |
CVE-2016-4305 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call… |
CVE-2016-4304 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the syscall filtering functionality of the Kaspersky Internet Security KLIF driver. A specially crafted native api… |
CVE-2016-6231 | Medium | 5.9 | 2016-08-25 | Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive infor… |
CVE-2015-8579 | | 2015-12-16 | Kaspersky Total Security 2015 15.0.2.361 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode proces… | |
CVE-2014-5654 | | 2014-09-09 | The Kaspersky Internet Security (aka com.kms.free) application 11.4.4.232 for Android does not verify X.509 certificates from SSL servers, which allows man-in-… | |
CVE-2010-5163 | | 2012-08-25 | Race condition in Kaspersky Internet Security 2010 9.0.0.736 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code t… | |
CVE-2012-1462 | | 2012-03-21 | The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0… | |
CVE-2012-1461 | | 2012-03-21 | The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0… | |
CVE-2012-1459 | | 2012-03-21 | The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677… | |
CVE-2012-1457 | | 2012-03-21 | The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender… | |
CVE-2012-1456 | | 2012-03-21 | The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0… | |
CVE-2012-1453 | | 2012-03-21 | The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos Anti-Virus 4.61.0, Trend Micro AntiVirus… | |
CVE-2012-1446 | | 2012-03-21 | The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, AVEngine 20101.3.0.103 in Symantec Endpoint Protec… | |
CVE-2012-1443 | | 2012-03-21 | The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symant… | |
CVE-2012-1442 | | 2012-03-21 | The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, eSafe… | |
CVE-2012-1425 | | 2012-03-21 | The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Anti… | |
CVE-2012-1420 | | 2012-03-21 | The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, K7 AntiVirus… | |
CVE-2009-4114 | | 2009-11-30 | kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463, and possibly other versions before 9.0.0.736, does not properly validate input to IOCTL 0x0022c008, which allow… | |
CVE-2009-3177 | | 2009-09-11 | Unspecified vulnerability in Kaspersky Online Scanner 7.0 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professi… | |
CVE-2009-2966 | | 2009-08-25 | avp.exe in Kaspersky Internet Security 9.0.0.459 and Anti-Virus 9.0.0.463 allows remote attackers to cause a denial of service (CPU consumption and network con… | |
CVE-2009-2647 | | 2009-07-30 | Unspecified vulnerability in Kaspersky Anti-Virus 2010 and Kaspersky Internet Security 2010 before Critical Fix 9.0.0.463 allows remote attackers to disable th… | |
CVE-2006-3074 | | 2006-06-19 | klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and 7.0, KAV 6.0 for Windows Workstations, and KAV 6.0 for Windows Servers… | |
CVE-2001-0789 | | 2001-10-18 | Format string vulnerability in avpkeeper in Kaspersky KAV 3.5.135.2 for Sendmail allows remote attackers to cause a denial of service or possibly execute arbit… |