CVE-2026-24712 | High | 7.3 | 2026-05-14 | Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection. |
CVE-2026-24711 | Medium | 5.3 | 2026-05-14 | Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control. |
CVE-2026-24710 | Medium | 6.1 | 2026-05-14 | Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS. |
CVE-2024-46948 | Medium | 4.3 | 2024-11-08 | Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control. |
CVE-2023-45684 | High | 7.5 | 2023-11-14 | Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The iss… |
CVE-2023-26560 | Medium | 6.5 | 2023-04-26 | Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and po… |
CVE-2022-32290 | Medium | 4.3 | 2022-07-06 | The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP prox… |
CVE-2022-29556 | Critical | 9.8 | 2022-04-28 | The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF prim… |
CVE-2022-29555 | High | 8.8 | 2022-04-28 | The Deviceconnect microservice through 1.3.0 in Northern.tech Mender Enterprise before 3.2.2. allows Cross-Origin Websocket Hijacking. |
CVE-2021-44216 | Medium | 5.5 | 2022-03-10 | Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to access the Apache… |
CVE-2021-44215 | Medium | 5.5 | 2022-03-10 | Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact. |
CVE-2021-38379 | Medium | 5.5 | 2021-10-27 | The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure. |
CVE-2021-36756 | Medium | 6.5 | 2021-10-27 | CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation. |
CVE-2021-35342 | High | 7.5 | 2021-08-27 | The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x before 2.6.1) allows us… |
CVE-2019-19394 | Medium | 6.1 | 2020-04-16 | Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS. This is fixed in 3.10.7, 3.12.3, and 3.15.0. |