CVE-2025-12776

>= 11.36.0 and <= 11.36.68

The Report Builder component of the application stores user input directly in a web page and displays it to other users, which rai

5.4MEDIUM

CVE-2025-57791

< 11.36.60

A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to

6.5MEDIUM

CVE-2025-57790

< 11.36.60

A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a pat

8.8HIGH

CVE-2025-57789

< 11.36.60

During the brief window between installation and the first administrator login, remote attackers may exploit the default credentia

5.4MEDIUM

CVE-2025-57788

< 11.36.60

A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credential

6.5MEDIUM

CVE-2025-3928

>= 11.20.0 and < 11.20.217

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the

8.8HIGH

CVE-2025-34028

>= 11.38.0 and < 11.38.20

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install package

10.0CRITICAL

CVE-2021-34997

all versions

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Alt

8.8HIGH

CVE-2021-34996

all versions

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Alt

8.8HIGH

CVE-2021-34995

all versions

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Alt

8.8HIGH

CVE-2021-34994

all versions

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Alt

8.8HIGH

CVE-2021-34993

all versions

This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22. Auth

9.8CRITICAL

CVE-2020-25780

< 14.68

In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory T

7.5HIGH

CVE-2017-18044

<= 11.0

A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsin

9.8CRITICAL

CVE-2017-3195

all versions

Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buf

9.8CRITICAL

CVE-2015-7253

all versions

The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized dat