Kaspersky vulnerabilities
76 vulnerabilities
Known vulnerabilities in Kaspersky products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 50 products.
Products
50- Kaspersky Anti Virus16 vulnerabilities
- Internet Security14 vulnerabilities
- Total Security10 vulnerabilities
- Anti Virus8 vulnerabilities
- Security Cloud7 vulnerabilities
- Small Office Security7 vulnerabilities
- Kaspersky Internet Security5 vulnerabilities
- Tigervnc5 vulnerabilities
- Anti Virus For Linux Server4 vulnerabilities
- Endpoint Security4 vulnerabilities
- Kaspersky Anti Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti Virus, Kaspersky Small Office Security, Kaspersky Security Cloud4 vulnerabilities
- Secure Mail Gateway4 vulnerabilities
- Tightvnc4 vulnerabilities
- Password Manager3 vulnerabilities
- Tinycheck3 vulnerabilities
- Vpn Secure Connection2 vulnerabilities
- Anti Ransomware Tool1 vulnerabilities
- Antivirus Engine1 vulnerabilities
- Embedded Systems Security1 vulnerabilities
- Free Anti Virus1 vulnerabilities
- Kaspersky Anti Virus, Kaspersky Internet Security, Kaspersky Total Security1 vulnerabilities
- Kaspersky Anti Virus Scanner1 vulnerabilities
- Kaspersky Anti Virus SDK For Windows1 vulnerabilities
- Kaspersky Endpoint Security1 vulnerabilities
- Kaspersky Internet Security 20101 vulnerabilities
- Kaspersky Online Scanner1 vulnerabilities
- Kaspersky Password Manager For Windows1 vulnerabilities
- Kaspersky Protection Extension For Google Chrome1 vulnerabilities
- Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud1 vulnerabilities
- Kaspersky Security For Linux Mail Server 81 vulnerabilities
- Kaspersky Security For Virtualization Light Agent1 vulnerabilities
- Libvnc1 vulnerabilities
- Protection1 vulnerabilities
- Rescue Disk1 vulnerabilities
- Safe Browser1 vulnerabilities
- Secure Connection1 vulnerabilities
- Security1 vulnerabilities
- Security Center1 vulnerabilities
- Security Center Web Console1 vulnerabilities
- Total Security 20151 vulnerabilities
- Turbovnc1 vulnerabilities
- Virus Removal Tool1 vulnerabilities
- Kaspersky Anti Ransomware Tool0 vulnerabilities
- Kaspersky Endpoint Security For Windows0 vulnerabilities
- Kaspersky For Windows (Standard, Plus, Premium)0 vulnerabilities
- Kaspersky Free0 vulnerabilities
- Kaspersky Industrial Cybersecurity For Linux Nodes0 vulnerabilities
- Kaspersky Safe Kids0 vulnerabilities
- Kaspersky Security Cloud0 vulnerabilities
- Kaspersky Small Office Security0 vulnerabilities
CVE-2018-6291kaspersky labskaspersky secure mail gateway+1
EPSS score0.85%
WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1.CVE-2018-6306kaspersky labkaspersky password manager+1EPSS score2.60%
Unauthorized code execution from specific DLL and is known as DLL Hijacking attack in Kaspersky Password Manager versions before 8.0.6.538.CVE-2018-6289kaspersky labskaspersky secure mail gateway+1EPSS score6.60%
Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.CVE-2018-6290kaspersky labskaspersky secure mail gateway+1EPSS score0.48%
Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1.CVE-2018-6288kaspersky labskaspersky secure mail gateway+1EPSS score0.64%
Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1.CVE-2021-26718kasperskyinternet_securityEPSS score0.22%
KIS for macOS in some use cases was vulnerable to AV bypass that potentially allowed an attacker to disable anti-virus protection.CVE-2021-27223kasperskyanti-virus+5EPSS score0.20%
A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security. A local user could cause Windows crash by running a specially crafted binary module. The fix was delivered automatically. Credits: (Straghkov Denis, Kurmangaleev Shamil, Fedotov Andrey, Kuts Daniil, Mishechkin Maxim, Akolzin Vitaliy) @ ISPRASCVE-2021-35052kasperskypassword_managerEPSS score0.34%
A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.CVE-2021-35053kasperskyendpoint_securityEPSS score2.60%
Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browser parameters file in a certain way and then reboot the system to make the system unbootable.CVE-2015-8579kasperskytotal_security_2015EPSS score1.49%
Kaspersky Total Security 2015 15.0.2.361 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.CVE-2016-4306kasperskytotal_securityEPSS score0.66%
Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver. Specially crafted IOCTL requests can cause the driver to return out-of-bounds kernel memory, potentially leaking sensitive information such as privileged tokens or kernel memory addresses that may be useful in bypassing kernel mitigations. An unprivileged user can run a program from user-mode to trigger this vulnerability.CVE-2016-4307kasperskyinternet_securityEPSS score0.50%
A denial of service vulnerability exists in the IOCTL handling functionality of Kaspersky Internet Security KL1 driver. A specially crafted IOCTL signal can cause an access violation in KL1 kernel driver resulting in local system denial of service. An attacker can run a program from user-mode to trigger this vulnerability.CVE-2016-4305kasperskyinternet_securityEPSS score0.49%
A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call can cause a access violation in KLIF kernel driver resulting in local denial of service. An attacker can run program from user-mode to trigger this vulnerability.CVE-2016-4329kasperskyanti-virus+2EPSS score0.57%
A local denial of service vulnerability exists in window broadcast message handling functionality of Kaspersky Anti-Virus software. Sending certain unhandled window messages, an attacker can cause application termination and in the same way bypass KAV self-protection mechanism.CVE-2016-4304kasperskyinternet_securityEPSS score0.49%
A denial of service vulnerability exists in the syscall filtering functionality of the Kaspersky Internet Security KLIF driver. A specially crafted native api call request can cause a access violation exception in KLIF kernel driver resulting in local denial of service. An attacker can run program from user-mode to trigger this vulnerability.CVE-2016-6231kasperskysafe_browserEPSS score1.28%
Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.CVE-2025-64984kasperskykaspersky endpoint securityEPSS score0.18%
Kaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux (any version with anti-virus databases prior to 18.11.2025), Kaspersky Industrial CyberSecurity for Linux Nodes (any version with anti-virus databases prior to 18.11.2025), and Kaspersky Endpoint Security for Mac (12.0.0.325, 12.1.0.553, and 12.2.0.694 with anti-virus databases prior to 18.11.2025) that could have allowed a reflected XSS attack to be carried out by an attacker using phishing techniques.CVE-2020-26200kasperskyendpoint_security+1EPSS score0.23%
A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk (KRD) and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security (KES). This issue allowed to bypass the UEFI Secure Boot security feature. An attacker would need physical access to the computer to exploit it. Otherwise, local administrator privileges would be required to modify the boot loader component.CVE-2020-36199kasperskytinycheckEPSS score2.21%
TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places.CVE-2020-36200kasperskytinycheckEPSS score0.80%
TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs.