Yandex vulnerabilities
Published CVEs affecting Yandex products: 5 record(s), with severity, exploitation and fixes.
CVE-2026-25865
High · 7.8
CWE-428 Jun 18, 2026
Punto Switcher 4.5.0.583 Unquoted Search Path via WinExec
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll Control_RunDLL input.dll. Attackers can place a malicious executable earlier in the search order to achieve arbitrary code execution in the context of the affected user.
CVE-2026-10549
Medium · 5.3
CWE-280 Jun 2, 2026
Privilege escalation in Yandex Database
LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass group membership checks resulting in unauthorized access to the database.
CVE-2025-5471
High · 7.8
CWE-427 Dec 9, 2025
Dylib Hijacking in Yandex Telemost
Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.
CVE-2025-5470
High · 7.3
CWE-427 Dec 9, 2025
Dylib Hijacking in Yandex Disk
Uncontrolled Search Path Element vulnerability in Yandex Disk on MacOS allows Search Order Hijacking.This issue affects Disk: before 3.2.45.3275.
CVE-2025-5469
High · 7.3
CWE-427 Dec 9, 2025
Dylib Hijacking in Yandex Messenger
Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245