CVE-2026-24712

< 3.21.8

Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.

7.3HIGH

CVE-2026-24711

< 3.21.8

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.

5.3MEDIUM

CVE-2026-24710

< 3.21.8

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.

6.1MEDIUM

CVE-2023-45684

< 3.18.6

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affec

7.5HIGH

CVE-2023-26560

>= 3.6.0 and < 3.21.1

Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature t

6.5MEDIUM

CVE-2021-44216

< 3.15.5

Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized loca

5.5MEDIUM

CVE-2021-44215

< 3.15.5

Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an

5.5MEDIUM

CVE-2021-38379

>= 3.6.7 and <= 3.18.0

The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure.

5.5MEDIUM

CVE-2021-36756

>= 3.15.0 and <= 3.15.4

CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation.

6.5MEDIUM

CVE-2019-19394

>= 3.10.0 and < 3.10.7

Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS. This is fixed in

6.1MEDIUM

CVE-2019-9929

all versions

Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions.

8.8HIGH

CVE-2005-3137

all versions

The (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local users to overwrite arbitrary files via a symlink attac

CVE-2005-2960

all versions

cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in,

CVE-2004-1702

all versions

The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the Recei

CVE-2004-1701

all versions

Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers

CVE-2003-0849

all versions

Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with

CVE-2000-0947

all versions

Format string vulnerability in cfd daemon in GNU CFEngine before 1.6.0a11 allows attackers to execute arbitrary commands via forma