YYandex

Products

Exploited and recent CVEs

• CVE-2026-25865 High 7.8 Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec 0.2%
• CVE-2026-10549 Medium 5.3 Privilege escalation in Yandex Database 0.3%
• CVE-2025-5469 High 7.3 Dylib Hijacking in Yandex Messenger 0.2%
• CVE-2025-5471 High 7.3 Dylib Hijacking in Yandex Telemost 0.2%
• CVE-2025-5470 High 7.3 Dylib Hijacking in Yandex Disk 0.2%
• CVE-2024-12168 High 8.4 DLL Hijacking in Yandex Telemost 0.2%
• CVE-2023-26226 High 7.4 A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682 0.4%
• CVE-2021-25262 Medium 6.9 Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack. 0.5%
• CVE-2021-25255 High 8.3 Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service. 0.8%
• CVE-2021-25254 High 8.2 Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar. 0.6%
• CVE-2024-6473 High 8.4 DLL Hijacking in Yandex Browser 0.7%
• CVE-2021-42391 Unrated Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0. 1.4%
• CVE-2021-42390 Unrated Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0. 1.3%
• CVE-2021-42389 Unrated Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0. 1.3%
• CVE-2021-42388 Unrated Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from t 1.6%
• CVE-2021-42387 Unrated Heap out-of-bounds read in Clickhouse's LZ4 compression codec when parsing a malicious query. As part of the LZ4::decompressImpl() loop, a 16-bit unsigned user-supplied value ('offset') is read from t 1.6%
• CVE-2021-43304 Unrated Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrar 1.7%
• CVE-2021-43305 Unrated Heap buffer overflow in Clickhouse's LZ4 compression codec when parsing a malicious query. There is no verification that the copy operations in the LZ4::decompressImpl loop and especially the arbitrar 1.7%
• CVE-2020-7369 Medium 4.3 Yandex Browser Address Bar Spooofing 1.0%