https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-36659.htmlhttps://patchthecve.com/cve/CVE-2023-36659.htmlWed, 17 Jun 2026 06:06:46 +0000CRITICAL 9.8: An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication).https://patchthecve.com/cve/CVE-2023-36657.htmlhttps://patchthecve.com/cve/CVE-2023-36657.htmlWed, 17 Jun 2026 06:06:46 +0000CRITICAL 9.8: An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.https://patchthecve.com/cve/CVE-2023-36658.htmlhttps://patchthecve.com/cve/CVE-2023-36658.htmlWed, 17 Jun 2026 06:06:46 +0000HIGH 7.8: An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally.https://patchthecve.com/cve/CVE-2022-40778.htmlhttps://patchthecve.com/cve/CVE-2022-40778.htmlWed, 17 Jun 2026 05:02:02 +0000MEDIUM 5.4: A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary JavaScript or HTML because of the blocked page response.https://patchthecve.com/cve/CVE-2022-32272.htmlhttps://patchthecve.com/cve/CVE-2022-32272.htmlWed, 17 Jun 2026 04:47:02 +0000CRITICAL 9.8: OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation.https://patchthecve.com/cve/CVE-2022-32273.htmlhttps://patchthecve.com/cve/CVE-2022-32273.htmlWed, 17 Jun 2026 04:47:02 +0000MEDIUM 4.3: As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate filenames on the server.