# cve.now: Naver

The newest entries naming Naver as an affected vendor (up to 200), of 42 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120988](https://cve.now/CVE-2026-120988.md): billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend… (CVSS 6.1)
- [CVE-2026-120987](https://cve.now/CVE-2026-120987.md): Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment. (CVSS 7.5)
- [CVE-2026-8148](https://cve.now/CVE-2026-8148.md): NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\\SYSTEM via registry manipu (CVSS 7.8)
- [CVE-2026-1513](https://cve.now/CVE-2026-1513.md): billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding. (CVSS 6.1)
- [CVE-2026-23769](https://cve.now/CVE-2026-23769.md): lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigure (CVSS 6.5)
- [CVE-2026-23768](https://cve.now/CVE-2026-23768.md): lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListen (CVSS 6.1)
- [CVE-2025-69235](https://cve.now/CVE-2025-69235.md): Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment. (CVSS 7.5)
- [CVE-2025-69234](https://cve.now/CVE-2025-69234.md): Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment. (CVSS 9.1)
- [CVE-2025-62585](https://cve.now/CVE-2025-62585.md): Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment. (CVSS 7.5)
- [CVE-2025-62584](https://cve.now/CVE-2025-62584.md): Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment. (CVSS 7.5)
- [CVE-2025-62583](https://cve.now/CVE-2025-62583.md): Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment. (CVSS 9.8)
- [CVE-2025-58323](https://cve.now/CVE-2025-58323.md): NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\\SYSTEM by executing arbitra (CVSS 7.7)
- [CVE-2025-58322](https://cve.now/CVE-2025-58322.md): NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\\SYSTEM by invoking arbitrar (CVSS 7.8)
- [CVE-2025-53600](https://cve.now/CVE-2025-53600.md): Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment. (CVSS 7.5)
- [CVE-2025-53599](https://cve.now/CVE-2025-53599.md): Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme. (CVSS 9.8)
- [CVE-2025-49223](https://cve.now/CVE-2025-49223.md): billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute (CVSS 9.8)
- [CVE-2024-50583](https://cve.now/CVE-2024-50583.md): Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to improper permission sett (CVSS 6.3)
- [CVE-2024-40618](https://cve.now/CVE-2024-40618.md): Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in (CVSS 9.6)
- [CVE-2024-28216](https://cve.now/CVE-2024-28216.md): nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause o (CVSS 5.4)
- [CVE-2024-28215](https://cve.now/CVE-2024-28215.md): nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause o (CVSS 7.5)
- [CVE-2024-28214](https://cve.now/CVE-2024-28214.md): nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker. (CVSS 2.7)
- [CVE-2024-28213](https://cve.now/CVE-2024-28213.md): nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbi (CVSS 9.8)
- [CVE-2024-28212](https://cve.now/CVE-2024-28212.md): nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization. (CVSS 9.8)
- [CVE-2024-28211](https://cve.now/CVE-2024-28211.md): nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI (CVSS 9.8)
- [CVE-2023-25632](https://cve.now/CVE-2023-25632.md): The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature. (no CVSS)
- [CVE-2020-9754](https://cve.now/CVE-2020-9754.md): NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode. (no CVSS)
- [CVE-2022-24077](https://cve.now/CVE-2022-24077.md): Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection. (no CVSS)
- [CVE-2022-24075](https://cve.now/CVE-2022-24075.md): Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP fi (no CVSS)
- [CVE-2022-24074](https://cve.now/CVE-2022-24074.md): Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script it (no CVSS)
- [CVE-2022-24073](https://cve.now/CVE-2022-24073.md): The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users acce (no CVSS)
- [CVE-2022-24072](https://cve.now/CVE-2022-24072.md): The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store we (no CVSS)
- [CVE-2022-24071](https://cve.now/CVE-2022-24071.md): A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controllin (no CVSS)
- [CVE-2021-33593](https://cve.now/CVE-2021-33593.md): Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may (no CVSS)
- [CVE-2021-33592](https://cve.now/CVE-2021-33592.md): NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. (no CVSS)
- [CVE-2021-33591](https://cve.now/CVE-2021-33591.md): An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted H (no CVSS)
- [CVE-2020-9753](https://cve.now/CVE-2020-9753.md): Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer. (no CVSS)
- [CVE-2020-9752](https://cve.now/CVE-2020-9752.md): Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through i (no CVSS)
- [CVE-2020-9751](https://cve.now/CVE-2020-9751.md): Naver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker's server and execute it during the up (no CVSS)
- [CVE-2019-13157](https://cve.now/CVE-2019-13157.md): nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename withi (no CVSS)
- [CVE-2019-13156](https://cve.now/CVE-2019-13156.md): NDrive(1.2.2).sys in Naver Cloud Explorer has a stack-based buffer overflow, which allows attackers to cause a denial of service when readin (no CVSS)
- [CVE-2018-12449](https://cve.now/CVE-2018-12449.md): The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking. (no CVSS)
- [CVE-2018-12448](https://cve.now/CVE-2018-12448.md): Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-ht (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/naver
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.