Parallels
148 CVEs across 17 Parallels products. Browse Parallels vulnerabilities, severities, and proof-of-concept exploits.
Parallels products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31359 | High | 8.8 | 2025-06-03 | A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). This vulnerability… |
CVE-2024-54189 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtu… |
CVE-2024-52561 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtu… |
CVE-2024-36486 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When… |
CVE-2025-30074 | High | 7.8 | 2025-03-16 | Alludo Parallels Desktop before 19.4.2 and 20.x before 20.2.2 for macOS on Intel platforms allows privilege escalation to root via the VM creation routine. |
CVE-2025-0413 | High | 7.8 | 2025-02-05 | Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privi… |
CVE-2024-6240 | High | 7.7 | 2024-06-21 | Improper privilege management vulnerability in Parallels Desktop Software, which affects versions earlier than 19.3.0. An attacker could add malicious code in… |
CVE-2024-6154 | Medium | 6.7 | 2024-06-20 | Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privilege… |
CVE-2024-6153 | High | 7.8 | 2024-06-20 | Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels softw… |
CVE-2023-50228 | High | 7.8 | 2024-05-03 | Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability. This vulnerability allows local attackers… |
CVE-2023-50227 | High | 8.3 | 2024-05-03 | Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2023-50226 | High | 7.8 | 2024-05-03 | Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2023-27328 | High | 7.8 | 2024-05-03 | Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2023-27327 | High | 7.5 | 2024-05-03 | Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2023-27326 | High | 8.2 | 2024-05-03 | Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on af… |
CVE-2023-27325 | High | 7.8 | 2024-05-03 | Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2023-27324 | High | 7.8 | 2024-05-03 | Parallels Desktop Updater Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2023-27323 | High | 7.8 | 2024-05-03 | Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges… |
CVE-2023-27322 | High | 7.8 | 2024-05-03 | Parallels Desktop Service Improper Initialization Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2023-45894 | Critical | 10.0 | 2023-12-14 | The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to a… |
CVE-2022-40870 | High | 8.1 | 2022-11-23 | The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbi… |
CVE-2022-34902 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34901 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34900 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (39313) Agent. An attacker must first obta… |
CVE-2022-34899 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34892 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. An attacker must firs… |
CVE-2022-34891 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. An attacker must firs… |
CVE-2022-34890 | High | 8.8 | 2022-07-18 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 17.1.1 (51537). An attacker must fir… |
CVE-2022-34889 | High | 8.2 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 17.1.1 (51537). An attacker must first obtain t… |
CVE-2021-34987 | High | 8.2 | 2022-07-15 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.1 (49187). An attacker must first obtain t… |
CVE-2021-34986 | High | 7.8 | 2022-07-15 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.5.0 (49183). An attacker must first obtain t… |
CVE-2022-30777 | Medium | 6.1 | 2022-05-16 | Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter. |
CVE-2021-34869 | High | 8.8 | 2022-01-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the… |
CVE-2021-34868 | High | 8.8 | 2022-01-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the… |
CVE-2021-34867 | High | 8.2 | 2022-01-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the… |
CVE-2020-8968 | High | 7.1 | 2021-12-17 | Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cy… |
CVE-2021-34864 | High | 8.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-34857 | High | 8.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-34856 | High | 8.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-34855 | Medium | 6.5 | 2021-10-25 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must fir… |
CVE-2021-34854 | High | 7.8 | 2021-10-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain t… |
CVE-2021-31432 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |
CVE-2021-31431 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |
CVE-2021-31430 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |
CVE-2021-31429 | High | 8.2 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the… |
CVE-2021-31428 | High | 8.2 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the… |
CVE-2021-31427 | Medium | 5.6 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |
CVE-2021-31426 | High | 8.8 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-49151. An attacker must first obtain the… |
CVE-2021-31425 | High | 8.8 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.2-49151. An attacker must first obtain the… |
CVE-2021-31424 | High | 8.8 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the… |
CVE-2021-31423 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first… |
CVE-2021-31422 | High | 7.5 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the… |
CVE-2021-31421 | Medium | 6.0 | 2021-04-29 | This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain… |
CVE-2021-31420 | High | 8.8 | 2021-04-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.0-48950. An attacker must first obtain the… |
CVE-2021-31419 | Medium | 6.5 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first… |
CVE-2021-31418 | Medium | 6.5 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first… |
CVE-2021-31417 | Medium | 6.5 | 2021-04-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An attacker must first… |
CVE-2021-27278 | High | 8.2 | 2021-04-22 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the… |
CVE-2021-27260 | Low | 3.2 | 2021-04-14 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first… |
CVE-2021-27259 | High | 7.8 | 2021-04-14 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the… |
CVE-2021-27244 | Medium | 6.5 | 2021-03-29 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first… |
CVE-2021-27243 | High | 8.8 | 2021-03-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the… |
CVE-2021-27242 | High | 8.8 | 2021-03-29 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-48919. An attacker must first obtain the… |
CVE-2020-35710 | Medium | 5.3 | 2020-12-25 | Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (even with blank c… |
CVE-2020-17402 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270). An attacker must fir… |
CVE-2020-17401 | Medium | 6.0 | 2020-08-25 | This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Desktop 15.1.4. An attacker must first obta… |
CVE-2020-17400 | High | 8.8 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abili… |
CVE-2020-17399 | High | 8.8 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abili… |
CVE-2020-17398 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abil… |
CVE-2020-17397 | High | 8.2 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abili… |
CVE-2020-17396 | High | 8.8 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abili… |
CVE-2020-17395 | High | 8.2 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the abili… |
CVE-2020-17394 | Medium | 6.0 | 2020-08-25 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtai… |
CVE-2020-17393 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain th… |
CVE-2020-17392 | High | 8.8 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain the… |
CVE-2020-17391 | Medium | 6.5 | 2020-08-25 | This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain th… |
CVE-2020-17390 | High | 8.8 | 2020-08-25 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the… |
CVE-2020-15860 | Critical | 9.9 | 2020-07-24 | Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any appli… |
CVE-2020-8876 | Medium | 5.5 | 2020-03-23 | This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain th… |
CVE-2020-8875 | High | 8.8 | 2020-03-23 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the… |
CVE-2020-8874 | Medium | 6.7 | 2020-03-23 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the… |
CVE-2020-8873 | Medium | 6.7 | 2020-03-23 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the… |
CVE-2020-8872 | Medium | 4.4 | 2020-03-23 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.1-47117. An attacker must first… |
CVE-2020-8871 | Medium | 6.7 | 2020-03-23 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.0-47107 . An attacker must first obtain th… |
CVE-2020-7213 | High | 7.5 | 2020-01-21 | Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date versions are presented with a pop-up w… |
CVE-2019-17148 | High | 7.8 | 2020-01-07 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 (45485). An at… |
CVE-2019-18793 | Medium | 6.1 | 2019-11-13 | Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter. |
CVE-2017-9447 | High | 7.5 | 2018-02-28 | In the web interface of Parallels Remote Application Server (RAS) 15.5 Build 16140, a vulnerability exists due to improper validation of the file path when req… |
CVE-2013-4878 | | 2013-07-18 | The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for ph… | |
CVE-2013-0133 | | 2013-04-18 | Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PA… | |
CVE-2013-0132 | | 2013-04-18 | The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitr… | |
CVE-2012-5004 | | 2012-09-19 | Multiple cross-site request forgery (CSRF) vulnerabilities in Parallels H-Sphere 3.3 Patch 1 allow remote attackers to hijack the authentication of admins for… | |
CVE-2012-1557 | | 2012-03-12 | SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10… | |
CVE-2011-4856 | | 2011-12-16 | The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 sends incorrect Content-Type headers for certain resources, which might allow remote attacke… | |
CVE-2011-4855 | | 2011-12-16 | The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow r… | |
CVE-2011-4854 | | 2011-12-16 | The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not ensure that Content-Type HTTP headers match the corresponding Content-Type data in… | |
CVE-2011-4853 | | 2011-12-16 | The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain p… | |
CVE-2011-4852 | | 2011-12-16 | The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates web pages containing external links in response to GET requests with query strings… | |
CVE-2011-4851 | | 2011-12-16 | The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it e… | |
CVE-2011-4850 | | 2011-12-16 | The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easie… |