Login Request a demo
SA
Product
Salt
by SaltStack · last CVE Jun 13, 2025
On CISA KEVExploited in the wild
52
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities52In the news0Timeline
Severity mix
Critical 16High 17Medium 10Low 2
Severity
All severities52Critical16High17Medium10Low2
Exploitation
On CISA KEV3Exploited in the wild3
Watch

Add Salt to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-11652
In wildKEV
6.5
86%
Apr 30
SaltStack Salt Path Traversal Vulnerability
Affected: before 2019.2.4; 3000 before 3000.2
CVE-2021-22004
6.4
0%
Sep 8
An issue was discovered in SaltStack Salt before 3003.3
Affected: before 3000.3
CVE-2020-28972
5.9
3%
Feb 27
In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate
Affected: before 2015.8.10; 2015.8.11 before 2015.8.13; 2016.3.0 before 2016.3.4; 2016.3.5 before 2016.3.6; 2016.3.7 before 2016.3.8; 2016.3.9 before 2016.11.3; +9 more
CVE-2016-3176
5.6
1%
Jan 31
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an…
Affected: through 2015.5.9; 2015.8.0; 2015.8.1; 2015.8.2; 2015.8.3; 2015.8.4; +2 more
CVE-2020-17490
5.5
0%
Nov 6
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions
Affected: before 2015.8.10; 2015.8.11 before 2015.8.13; 2016.3.0 before 2016.3.4; 2016.3.5 before 2016.3.6; 2016.3.7 before 2016.3.8; 2016.11.0 before 2016.11.3; +8 more
CVE-2023-20897
5.3
1%
Sep 5
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return
Affected: before 3005.2; 3006.0 before 3006.2
CVE-2018-15750
5.3
4%
Oct 24
Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server
Affected: before 2017.7.8; 2018.3.0 before 2018.3.3
CVE-2015-1839
5.3
0%
Apr 13
modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp
Affected: through 2014.7.3
CVE-2015-1838
5.3
0%
Apr 13
modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp
Affected: through 2014.7.3
CVE-2021-25284
4.4
1%
Feb 27
An issue was discovered in through SaltStack Salt before 3002.5
Affected: before 2015.8.10; 2015.8.11 before 2015.8.13; 2016.3.0 before 2016.3.4; 2016.3.5 before 2016.3.6; 2016.3.7 before 2016.3.8; 2016.3.9 before 2016.11.3; +9 more
Showing 10