Manager
32 CVEs tracked. 3 of them are in CISA KEV.
This hub aggregates every CVE we track for Manager, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Manager CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 1 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 1 |
| 2025-12 | 3 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 32 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High11
- Medium11
- Low4
Latest CVEs
The 15 most recently published vulnerabilities affecting Manager.
- CVE-2025-34181NetSupport Manager < 14.12.0001 Authenticated Path Traversal Arbitrary File Write RCE—
- CVE-2025-34180NetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential Recovery—
- CVE-2025-34179NetSupport Manager < 14.12.0001 Unauthenticated SQLi Local File Disclosure—
- CVE-2025-64180Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)10.0
- CVE-2025-54122Manager-io/Manager allows unauthenticated full read server-side request forgery in "proxy" endpoint10.0
- CVE-2011-1597OpenVAS Manager v2.0.3 allows plugin remote code execution.8.8
- CVE-2019-16967An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form (html\admin\modules\manager\views\form.php), an unsanitized manag...6.1
- CVE-2019-3684susemanager installer creates world-readable swap files5.9
- CVE-2015-5300The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP ...7.5
- CVE-2015-5219The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (inf...7.5
- CVE-2015-5194The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.7.5
- CVE-2017-7995Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in ...3.8
- CVE-2016-4948Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Template Name field when renaming a...6.1
- CVE-2016-4949Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the filename parameter to /cmf/process/<process_id>/logs.7.5
- CVE-2016-4950Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions.7.5
Product grouping is registry-driven, with AI assist and human review. How it works