# cve.now: Netatalk

The newest entries naming Netatalk as an affected vendor (up to 200), of 43 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-45698](https://cve.now/CVE-2026-45698.md): Netatalk has Integer Underflow → Stack Buffer Overflow in deletedir() (CVSS 7.5)
- [CVE-2026-45699](https://cve.now/CVE-2026-45699.md): Netatalk has Integer Underflow → Stack Buffer Overflow in copydir() (CVSS 7.5)
- [CVE-2026-7837](https://cve.now/CVE-2026-7837.md): TOCTOU with root privilege in ad\_flush (CVSS 3.7)
- [CVE-2026-44075](https://cve.now/CVE-2026-44075.md): Missing break in DSI OpenSession (CVSS 3.7)
- [CVE-2026-44074](https://cve.now/CVE-2026-44074.md): Bitwise OR of errno values (CVSS 3.7)
- [CVE-2026-44071](https://cve.now/CVE-2026-44071.md): FORTIFY\_SOURCE disabled (CVSS 3.7)
- [CVE-2026-44057](https://cve.now/CVE-2026-44057.md): Dead bounds check in Spotlight RPC unmarshaller (CVSS 3.1)
- [CVE-2026-7836](https://cve.now/CVE-2026-7836.md): hextoint macro uppercase bug (CVSS 3.1)
- [CVE-2026-7835](https://cve.now/CVE-2026-7835.md): Format string argument mismatch (CVSS 3.1)
- [CVE-2026-44076](https://cve.now/CVE-2026-44076.md): Shell injection via volume path (CVSS 6.7)
- [CVE-2026-44073](https://cve.now/CVE-2026-44073.md): seteuid failure ignored in auth modules (CVSS 4.0)
- [CVE-2026-44072](https://cve.now/CVE-2026-44072.md): system() after failed chdir() (CVSS 2.5)
- [CVE-2026-44070](https://cve.now/CVE-2026-44070.md): Unbounded realloc in charset conversion (CVSS 3.1)
- [CVE-2026-44069](https://cve.now/CVE-2026-44069.md): Integer underflow in volxlate (CVSS 3.4)
- [CVE-2026-44068](https://cve.now/CVE-2026-44068.md): EA path traversal via incomplete sanitization (CVSS 7.6)
- [CVE-2026-44067](https://cve.now/CVE-2026-44067.md): EA header parsing heap over-read (CVSS 3.7)
- [CVE-2026-44066](https://cve.now/CVE-2026-44066.md): Heap out-of-bounds reads in Spotlight RPC unmarshalling (CVSS 7.1)
- [CVE-2026-44065](https://cve.now/CVE-2026-44065.md): Off-by-two in papd lp\_write() (CVSS 3.7)
- [CVE-2026-44064](https://cve.now/CVE-2026-44064.md): ASP session ID out-of-bounds access (CVSS 7.1)
- [CVE-2026-44063](https://cve.now/CVE-2026-44063.md): LDAP filter injection (CVSS 4.2)
- [CVE-2026-44062](https://cve.now/CVE-2026-44062.md): Missing o\_len bounds check in pull\_charset\_flags() (CVSS 7.5)
- [CVE-2026-44061](https://cve.now/CVE-2026-44061.md): DES-ECB auth with timing side channel (CVSS 5.9)
- [CVE-2026-44060](https://cve.now/CVE-2026-44060.md): Integer underflow in dsi\_writeinit() leads to denial of service (CVSS 7.5)
- [CVE-2026-44059](https://cve.now/CVE-2026-44059.md): Non-reentrant privilege toggle (CVSS 3.9)
- [CVE-2026-44058](https://cve.now/CVE-2026-44058.md): Authentication bypass via admin auth user (CVSS 6.4)
- [CVE-2026-44056](https://cve.now/CVE-2026-44056.md): Stack buffer overflow in desktop.c (CVSS 6.0)
- [CVE-2026-44055](https://cve.now/CVE-2026-44055.md): Bitwise OR logic bug enables shell injection (CVSS 7.5)
- [CVE-2026-44054](https://cve.now/CVE-2026-44054.md): Predictable afpd session token (CVSS 6.5)
- [CVE-2026-44053](https://cve.now/CVE-2026-44053.md): Weak cryptography in DHCAST128 UAM (CVSS 7.4)
- [CVE-2026-44052](https://cve.now/CVE-2026-44052.md): LDAP simple-bind password exposure in log output (CVSS 7.5)
- [CVE-2026-44051](https://cve.now/CVE-2026-44051.md): Arbitrary file read via attacker-controlled symlink creation (CVSS 8.1)
- [CVE-2026-44050](https://cve.now/CVE-2026-44050.md): Heap buffer overflow in CNID daemon comm\_rcv() (CVSS 9.9)
- [CVE-2026-44049](https://cve.now/CVE-2026-44049.md): Out-of-bounds write in convert\_charset() null termination (CVSS 7.5)
- [CVE-2026-44048](https://cve.now/CVE-2026-44048.md): Stack buffer overflow via UCS-2 type confusion in convert\_charset() (CVSS 8.8)
- [CVE-2026-44047](https://cve.now/CVE-2026-44047.md): SQL injection in MySQL CNID backend (CVSS 8.8)
- [CVE-2022-43634](https://cve.now/CVE-2022-43634.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. (CVSS 9.8)
- [CVE-2022-23125](https://cve.now/CVE-2022-23125.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. (CVSS 9.8)
- [CVE-2022-23124](https://cve.now/CVE-2022-23124.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. (CVSS 5.3)
- [CVE-2022-23123](https://cve.now/CVE-2022-23123.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. (CVSS 5.3)
- [CVE-2022-23122](https://cve.now/CVE-2022-23122.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. (CVSS 9.8)
- [CVE-2022-23121](https://cve.now/CVE-2022-23121.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. (CVSS 9.8)
- [CVE-2022-0194](https://cve.now/CVE-2022-0194.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. (CVSS 9.8)
- [CVE-2018-1160](https://cve.now/CVE-2018-1160.md): Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi\_opensess.c. (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/netatalk
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.