storage vulnerabilities and fixes

Recent CVEs affecting storage, with upgrade or downgrade steps. 20 tracked.

storage has 20 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 18. Most recent: 2026-03-20. Highest priority: CVE-2022-26148 (score 74/100).

• CVE-2026-33221 MEDIUM 5.3 UPGRADE Nhost is an open source Firebase alternative with GraphQL
• CVE-2023-4091 MEDIUM 6.5 UPGRADE MITIGATE A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-o
• CVE-2023-42669 MEDIUM 6.5 UPGRADE DOWNGRADE A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba
• CVE-2023-3961 CRITICAL 9.1 UPGRADE DOWNGRADE A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix do
• CVE-2023-3347 MEDIUM 5.9 UPGRADE DOWNGRADE A vulnerability was found in Samba's SMB2 packet signing mechanism
• CVE-2023-34968 MEDIUM 5.3 UPGRADE MITIGATE A path disclosure vulnerability was found in Samba
• CVE-2022-2447 MEDIUM 6.6 MITIGATE DOWNGRADE A flaw was found in Keystone
• CVE-2022-26148 CRITICAL 9.8 UPGRADE DOWNGRADE An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix
• CVE-2021-44141 MEDIUM 4.3 UPGRADE DOWNGRADE All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine
• CVE-2021-3670 MEDIUM 6.5 UPGRADE DOWNGRADE MaxQueryDuration not honoured in Samba AD DC LDAP
• CVE-2021-20291 MEDIUM 6.5 UPGRADE DOWNGRADE A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1
• CVE-2020-14318 MEDIUM 4.3 UPGRADE DOWNGRADE A flaw was found in the way samba handled file and directory permissions
• CVE-2020-10730 MEDIUM 6.5 UPGRADE DOWNGRADE A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions befo
• CVE-2020-10685 MEDIUM 5.0 UPGRADE UPGRADE A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.
• CVE-2019-14907 MEDIUM 6.5 UPGRADE MITIGATE All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if
• CVE-2014-3470 MEDIUM 4.3 UPGRADE DOWNGRADE The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.
• CVE-2014-0224 HIGH 7.4 UPGRADE DOWNGRADE OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of
• CVE-2014-0221 MEDIUM 4.3 UPGRADE DOWNGRADE The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1
• CVE-2013-4280 MEDIUM 5.5 DOWNGRADE DOWNGRADE Insecure temporary file vulnerability in RedHat vsdm 4.9.6.
• CVE-2012-4406 CRITICAL 9.8 UPGRADE MITIGATE OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely whe

FAQ

How do I fix storage vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is storage being exploited right now?

None of the tracked storage CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which storage CVE should I patch first?

CVE-2022-26148 currently ranks highest (74/100): An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix.

RSS feed for storage · ← Back to latest CVEs