Yandex

32 CVEs across 17 Yandex products. Browse Yandex vulnerabilities, severities, and proof-of-concept exploits.

Yandex products with known CVEs

ProductCVEs
Yandex Browser22
Clickhouse7
Browser3
Browser Lite2
Navigator2
Telemost2
Yandex Telemost2
Disk1
Messenger1
Punto Switcher1
Tomita-Parser1
Yandex Browser1
Yandex.browser1
Yandex Database1
Yandex.server1
Yandex.server 20101
Yandex Turbo1
Yandex CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-25865High7.82026-06-18Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the…
CVE-2026-105492026-06-02LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership check…
CVE-2025-5471High7.82025-12-09Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.
CVE-2025-54702025-12-09Uncontrolled Search Path Element vulnerability in Yandex Disk on MacOS allows Search Order Hijacking.This issue affects Disk: before 3.2.45.3275.
CVE-2025-54692025-12-09Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245
CVE-2024-12168High7.82025-06-02Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.
CVE-2023-26226Critical9.82025-05-30A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682
CVE-2021-25262Medium5.42025-05-21Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.
CVE-2021-25255High7.52025-05-21Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.
CVE-2021-25254Medium5.32025-05-21Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.
CVE-2024-6473High7.82024-09-03Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.
CVE-2023-29751Medium5.52023-06-09An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause a persistent denial of service by manipulating the SharedPreference fil…
CVE-2023-29749High7.82023-06-09An issue found in Yandex Navigator v.6.60 for Android allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference fi…
CVE-2022-28226High7.82022-06-15Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary code with the SYST…
CVE-2022-28225High7.82022-06-15Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYST…
CVE-2021-25261High7.82022-06-15Local privilege vulnerability in Yandex Browser for Windows prior to 22.5.0.862 allows a local, low privileged, attacker to execute arbitary code with the SYST…
CVE-2021-43305High8.82022-03-14Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decomp…
CVE-2021-43304High8.82022-03-14Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decomp…
CVE-2021-42391Medium6.52022-03-14Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation…
CVE-2021-42390Medium6.52022-03-14Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operat…
CVE-2021-42389Medium6.52022-03-14Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation wi…
CVE-2021-42388High8.12022-03-14Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user…
CVE-2021-42387High8.12022-03-14Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user…
CVE-2020-27970Medium5.32021-09-13Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar
CVE-2020-27969High7.32021-09-13Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing
CVE-2021-25263High7.82021-08-17Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary code with the SYST…
CVE-2021-24428Medium4.82021-08-02The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving and outputing them in the admin dashboard…
CVE-2020-7369Medium4.32020-10-20User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true s…
CVE-2016-10666High8.12018-05-29tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may…
CVE-2017-7327High7.82018-01-19Yandex Browser installer for Desktop before 17.4.1 has a DLL Hijacking Vulnerability because an untrusted search path is used for dnsapi.dll, winmm.dll, ntmart…
CVE-2017-7326High7.52018-01-19Race condition issue in Yandex Browser for Android before 17.4.0.16 allowed a remote attacker to potentially exploit memory corruption via a crafted HTML page
CVE-2017-7325High7.52018-01-19Yandex Browser before 16.9.0 allows remote attackers to spoof the address bar via window.open.
CVE-2016-8508Medium6.52017-03-01Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which…
CVE-2016-8507Medium6.52017-03-01Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initiate facetime-call w…
CVE-2016-8506Medium6.12016-10-26XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javasc…
CVE-2016-8505Medium6.12016-10-26XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript c…
CVE-2016-8504Medium4.32016-10-26CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile.
CVE-2016-8503High7.32016-10-26Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from…
CVE-2016-8502High7.32016-10-26Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords fr…
CVE-2016-8501Medium5.32016-10-26Security WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi networks despite of s…
CVE-2012-29412012-05-27Cross-site scripting (XSS) vulnerability in search/ in Yandex.Server 2010 9.0 Enterprise allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2007-34852007-06-28Multiple cross-site scripting (XSS) vulnerabilities in Yandex.Server allow remote attackers to inject arbitrary web script or HTML via the (1) query or (2) wit…