Skip to content
OpenAdvisories

Vendor

Yandex

19 known vulnerabilities.

Yandex at a glance

Last 12 months
5
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 3 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202620
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202530
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202510
May 202540
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

clickhouse 7 Browser 3 Telemost 2 Browser Lite 2 Yandex Browser 1 Punto Switcher 1 Disk 1 Messenger 1 Yandex Database 1
All Critical High Medium Low Exploited only Public exploit

19 results · Feed

  • High 7.8
    CVE-2026-25865

    Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec

    Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32…

    Yandex Punto Switcher
  • Medium 5.3
    CVE-2026-10549

    Privilege escalation in Yandex Database

    LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership checks resulting in unauthorized access to the database.

    Yandex Yandex Database
  • High 7.3
    CVE-2025-5469

    Dylib Hijacking in Yandex Messenger

    Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245

    Yandex Messenger
  • High 7.3
    CVE-2025-5471

    Dylib Hijacking in Yandex Telemost

    Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.

    Yandex Telemost
  • High 7.3
    CVE-2025-5470

    Dylib Hijacking in Yandex Disk

    Uncontrolled Search Path Element vulnerability in Yandex Disk on MacOS allows Search Order Hijacking.This issue affects Disk: before 3.2.45.3275.

    Yandex Disk
  • High 8.4
    CVE-2024-12168

    DLL Hijacking in Yandex Telemost

    Yandex Telemost for Desktop before 2.7.0 has a DLL Hijacking Vulnerability because an untrusted search path is used.

    Yandex Telemost
  • High 7.4
    CVE-2023-26226

    A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682

    A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682

    Yandex Browser
  • Medium 6.9
    CVE-2021-25262

    Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.

    Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.

    Yandex Browser
  • High 8.3
    CVE-2021-25255

    Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.

    Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.

    Yandex Browser Lite
  • High 8.2
    CVE-2021-25254

    Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.

    Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.

    Yandex Browser Lite
  • High 8.4
    CVE-2024-6473 Public exploit

    DLL Hijacking in Yandex Browser

    Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.

    Yandex Browser
  • Unscored —
    CVE-2021-42391

    Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compress…

    Yandex clickhouse
  • Unscored —
    CVE-2021-42390

    Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the comp…

    Yandex clickhouse
  • Unscored —
    CVE-2021-42389

    Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed…

    Yandex clickhouse
  • Unscored —
    CVE-2021-42387

    Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decom…

    Yandex clickhouse clickhouse clickhouse Debian Ubuntu
  • Unscored —
    CVE-2021-42388

    Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decom…

    Yandex clickhouse clickhouse clickhouse Debian Ubuntu
  • Unscored —
    CVE-2021-43304

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification tha…

    Yandex clickhouse clickhouse Debian
  • Unscored —
    CVE-2021-43305

    Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification tha…

    Yandex clickhouse clickhouse clickhouse Debian Ubuntu
  • Medium 4.3
    CVE-2020-7369

    Yandex Browser Address Bar Spooofing

    User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser allows an attacker to obfuscate the true source of data as presented in the browser. This issue affects the Yandex Browser version 20.8.3 and …

    Yandex Yandex Browser