Priority MEDIUM 42
Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.0092 · Published 2026-05-14 · No fix listed CWE-77
Priority LOW 29
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00208 · Published 2026-05-14 · No fix listed CWE-284
Priority LOW 26
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00166 · Published 2026-05-14 · No fix listed CWE-79
Priority MEDIUM 40
Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00647 · Published 2023-11-14 · No fix listed CWE-89
Priority LOW 30
Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and potentially discover credentials.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00546 · Published 2023-04-25 · No fix listed CWE-203
Priority LOW 25
Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00354 · Published 2022-03-07 · No fix listed CWE-276
Priority LOW 25
Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to access the Apache and Mission Portal log files.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00362 · Published 2022-03-07 · No fix listed CWE-276
Priority LOW 29
CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00417 · Published 2021-10-27 · No fix listed CWE-295
Priority LOW 24
The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00214 · Published 2021-10-27 · No fix listed CWE-276
Priority LOW 28
Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00641 · Published 2020-04-16 · No fix listed CWE-79
THREATIST.IORead the docs