CY
Vendor
Cyberark
32
CVEs
0
On KEV
0
New 30D
Products
EP9.8
Endpoint Privilege Manager
Cyberark
8 CVEs0 on KEV0 new
ID6.5
Identity
Cyberark
6 CVEs0 on KEV0 new
CO9.8
conjur
cyberark
5 CVEs0 on KEV0 new
CP7.5
Credential Provider
Cyberark
3 CVEs0 on KEV0 new
PV9.8
Password Vault
Cyberark
2 CVEs0 on KEV0 new
CO9.0
Conjur Oss Helm Chart
Cyberark
1 CVEs0 on KEV0 new
CS7.8
Conjur Service Broker
Cyberark
1 CVEs0 on KEV0 new
CS4.8
CyberArk Secure Web Sessions Extension
CyberArk
1 CVEs0 on KEV0 new
EP9.8
Enterprise Password Vault
Cyberark
1 CVEs0 on KEV0 new
ID5.3
IDP
CyberArk
1 CVEs0 on KEV0 new
PA6.1
Privileged Access Manager
Cyberark
1 CVEs0 on KEV0 new
PS2.6
Privileged Session Manager
Cyberark
1 CVEs0 on KEV0 new
VI7.8
Viewfinity
Cyberark
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-2914 | EP Endpoint Privilege Manager Cyberark | 7.8 | Feb 25 | CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and lower allow potential unauthorized privilege elevation leveraging CyberArk elevation dialogs |
| CVE-2025-66374 | EP Endpoint Privilege Manager Cyberark | 7.8 | Feb 3 | CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of an Administration task |
| CVE-2025-13762 | CS CyberArk Secure Web Sessions Extension CyberArk | 4.8 | Nov 27 | Client-Side Denial of Service Condition in SWS Extension prior to version 2.2.30305 |
| CVE-2025-46382 | ID IDP CyberArk | 5.3 | Jul 20 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
| CVE-2025-49831 | CO conjur cyberark | 9.8 | Jul 15 | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to IAM Authenticator Bypass via Mis-configured Network Device |
| CVE-2025-49830 | CO conjur cyberark | 6.5 | Jul 15 | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to path traversal and file disclosure |
| CVE-2025-49829 | CO conjur cyberark | 6.5 | Jul 15 | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations |
| CVE-2025-49828 | CO conjur cyberark | 8.8 | Jul 15 | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution |
| CVE-2025-49827 | CO conjur cyberark | 9.8 | Jul 15 | Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator |
| CVE-2024-54840 | PA Privileged Access Manager Cyberark | 6.1 | Feb 3 | PVWA (Password Vault Web Access) in CyberArk Privileged Access Manager Self-Hosted before 14.4 does not properly address environment issues that can contribute to Host header… |
| CVE-2024-42340 | ID Identity Cyberark | 4.3 | Aug 25 | CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security |
| CVE-2024-42339 | ID Identity Cyberark | 4.3 | Aug 25 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
| CVE-2024-42338 | ID Identity Cyberark | 4.3 | Aug 25 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
| CVE-2024-42337 | ID Identity Cyberark | 6.5 | Aug 25 | CyberArk - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor |
| CVE-2017-11197 | VI Viewfinity Cyberark | 7.8 | May 3 | In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user via a bug within the "add printer" option |
| CVE-2022-22700 | ID Identity Cyberark | 5.3 | Mar 3 | CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header 'X-CFY-TX-TM' |
| CVE-2021-44049 | EP Endpoint Privilege Manager Cyberark | 7.8 | Jan 15 | CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp… |
| CVE-2021-31798 | CP Credential Provider Cyberark | 4.4 | Sep 2 | The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain conditions a local malicious user can obtain the… |
| CVE-2021-31796 | CP Credential Provider Cyberark | 7.5 | Sep 2 | An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure |
| CVE-2021-31797 | CP Credential Provider Cyberark | 5.1 | Sep 2 | The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading to password disclosure |
| CVE-2021-37151 | ID Identity Cyberark | 5.3 | Sep 1 | CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid |
| CVE-2020-25738 | EP Endpoint Privilege Manager Cyberark | 5.5 | Nov 27 | CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL into a process that normally has… |
| CVE-2020-25374 | PS Privileged Session Manager Cyberark | 2.6 | Oct 28 | CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time |
| CVE-2020-4062 | CO Conjur Oss Helm Chart Cyberark | 9.0 | Jun 22 | In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres database with an open port |
| CVE-2019-3800 | CS Conjur Service Broker Cyberark | 7.8 | Aug 5 | CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag |
| CVE-2019-7442 | EP Enterprise Password Vault Cyberark | 9.8 | May 8 | An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read arbitrary files or… |
| CVE-2018-14894 | EP Endpoint Privilege Manager Cyberark | 7.8 | Apr 9 | CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended access restrictions and execute… |
| CVE-2019-9627 | EP Endpoint Privilege Manager Cyberark | 7.0 | Mar 8 | A buffer overflow in the kernel driver CybKernelTracker.sys in CyberArk Endpoint Privilege Manager versions prior to 10.7 allows an attacker (without Administrator privileges) to… |
| CVE-2018-13052 | EP Endpoint Privilege Manager Cyberark | 9.8 | Jul 5 | In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is possible if the attacker has one process that executes as Admin |
| CVE-2018-12903 | EP Endpoint Privilege Manager Cyberark | 5.4 | Jun 26 | In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on the create token screen, the VfManager.asmx… |
| CVE-2018-9843 | PV Password Vault Cyberark | 9.8 | Apr 12 | The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an… |
| CVE-2018-9842 | PV Password Vault Cyberark | 5.3 | Apr 12 | CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replaying a logon message |