Product by Open Source
Samba
20 known vulnerabilities in Samba (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
20
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2007-4559 | Python Software Foundation CPython: Path Traversal | 9.8 | |
| Critical | CVE-2026-6949 | open source Samba: security vulnerability | — | |
| Critical | CVE-2026-58221 | open source Samba: security vulnerability | — | |
| Critical | CVE-2026-4480 | Samba: samba: remote code execution in printing subsystem via unescaped job description | 9.0 | |
| Critical | CVE-2026-4408 | Samba: remote code execution in samr | 9.8 | |
| High | CVE-2023-34966 | Samba: infinite loop in mdssvc rpc service for spotlight | 7.5 | |
| High | CVE-2026-3238 | Samba: denial of service against ad dc wins server | 7.5 | |
| Medium | CVE-2023-34967 | Samba: type confusion in mdssvc rpc service for spotlight | 5.3 | |
| High | CVE-2026-58222 | Red Hat: LDAP Injection | 8.8 | |
| High | CVE-2026-40170 | ngtcp2 has a qlog transport parameter serialization stack buffer overflow | 7.5 | |
| Medium | CVE-2022-2127 | Samba: out-of-bounds read in winbind auth_crap | 5.9 | |
| Medium | CVE-2026-2340 | Samba: vfs_worm does not block directory modification | 6.5 | |
| High | CVE-2026-1933 | Samba: missing access check on reparse point operations | 6.5 | |
| Medium | CVE-2026-58218 | Samba: dns signing dos via tkey name cache exhaustion | 5.3 | |
| High | CVE-2026-109411 | Samba: access control bypass via vfs_ceph_rgw case-insensitive open | 8.1 | |
| Medium | CVE-2023-34968 | Samba: spotlight server-side share path disclosure | 5.3 | |
| Medium | CVE-2026-58224 | Samba: ctdb fails to do integrity checking of received packets | 6.5 | |
| Medium | CVE-2026-58216 | Red Hat: Out-of-bounds Read | 5.3 | |
| High | CVE-2026-3012 | Samba: group policy certificate enrollment uses http:// without validation | 6.8 | |
| Medium | CVE-2023-3347 | Samba: smb2 packet signing is not enforced when "server signing = required" is set | 5.9 |