CVE-2026-6066

< 2026.4

ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solut

7.1HIGH

CVE-2025-11493

< 2025.9

The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, depend

8.8HIGH

CVE-2025-11492

< 2025.9

In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path thre

9.6CRITICAL

CVE-2025-8868

< 4.13.295

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Che

9.8CRITICAL

CVE-2025-6724

< 4.13.295

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Che

8.8HIGH

CVE-2023-47257

all versions

ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.

8.1HIGH

CVE-2023-47256

all versions

ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy sett

5.5MEDIUM

CVE-2023-40050

<= 4.10.29

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check com

9.9CRITICAL

CVE-2023-23130

all versions

Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL

5.9MEDIUM

CVE-2023-23126

all versions

Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perfor

6.1MEDIUM

CVE-2021-35066

< 2021.0.6.132

An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.

9.8CRITICAL

CVE-2020-15838

< 2020.8

The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak pe

8.8HIGH

CVE-2020-15027

< 2019.12

ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass vi

9.8CRITICAL