Skip to content
Noroxi

GFI records

50 published records for vendor gfi.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
12%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 19
  3. 22
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

50 records
  • CVE-2024-52875
    44Plan

    An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5.

    HighCVSS 8.8Proof of conceptEPSS 29%

    gfi · kerio controlJan 31, 2025

  • CVE-2004-1312
    41Plan

    A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a

    CriticalCVSS 10.0No exploitEPSS 2%

    gfi · mailessentialsJan 3, 2005

  • CVE-2021-29281
    40Plan

    File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which

    CriticalCVSS 9.8No exploitEPSS 2%

    gfi · archiverJul 7, 2022

  • CVE-2025-34070
    40Plan

    GFI Kerio Control GFIAgent Missing Authentication on Administrative Interfaces

    CriticalCVSS 10.0No exploitEPSS 0%

    gfi · kerio controlJul 2, 2025

  • CVE-2024-11948
    39Monitor

    GFI Archiver Telerik Web UI Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 1%

    gfi · archiverDec 11, 2024

  • CVE-2026-2039
    39Monitor

    GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    gfi · archiverFeb 20, 2026

  • CVE-2026-2038
    39Monitor

    GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    gfi · archiverFeb 20, 2026

  • CVE-2025-34069
    38Monitor

    GFI Kerio Control GFIAgent Authentication Bypass via Proxy Forwarding

    CriticalCVSS 9.5Proof of conceptEPSS 0%

    gfi · kerio controlJul 2, 2025

  • CVE-2025-34071
    37Monitor

    GFI Kerio Control Unsigned System Image Upload Root Code Execution

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    gfi · kerio controlJul 2, 2025

  • CVE-2026-2036
    35Monitor

    GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    gfi · archiverFeb 20, 2026

  • CVE-2026-2037
    35Monitor

    GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    gfi · archiverFeb 20, 2026

  • CVE-2023-25267
    35Monitor

    An issue was discovered in GFI Kerio Connect 9.4.1 patch 1 (fixed in 10.0.0).

    HighCVSS 8.8No exploitEPSS 1%

    gfi · kerio connectMar 15, 2023

  • CVE-2025-34491
    35Monitor

    GFI MailEssentials < 21.8 MultiNode Insecure Deserialization

    HighCVSS 8.8No exploitEPSS 0%

    gfi · mailessentialsApr 28, 2025

  • CVE-2024-11949
    35Monitor

    GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    gfi · archiverDec 11, 2024

  • CVE-2024-11947
    35Monitor

    GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    gfi · archiverDec 11, 2024

  • CVE-2002-1121
    32Monitor

    SMTP content filter engines, including (1) GFI MailSecurity for Exchange/SMTP before 7.2, (2) InterScan VirusWall before 3.52 build 1494, (3

    HighCVSS 7.5No exploitEPSS 6%

    gfi · mailsecuritySep 24, 2002

  • CVE-2005-3182
    31Monitor

    Buffer overflow in the HTTP management interface for GFI MailSecurity 8.1 allows remote attackers to execute arbitrary code via long headers

    HighCVSS 7.5No exploitEPSS 3%

    gfi · mailsecurityOct 20, 2005

  • CVE-2025-34489
    31Monitor

    GFI MailEssentials < 21.8 Local Privilege Escalation

    HighCVSS 7.8No exploitEPSS 0%

    gfi · mailessentialsApr 28, 2025

  • CVE-2010-5181
    28Monitor

    Race condition in VIPRE Antivirus Premium 4.0.3272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangero

    HighCVSS 7.0No exploitEPSS 0%

    gfi · vipre antivirusAug 25, 2012

  • CVE-2010-5254
    27Monitor

    Untrusted search path vulnerability in GFI Backup 3.1 Build 20100730 2009 Home Edition allows local users to gain privileges via a Trojan ho

    MediumCVSS 6.9No exploitEPSS 0%

    gfi · gfi backup 2009Sep 7, 2012

  • CVE-2017-7440
    26Monitor

    Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview

    MediumCVSS 6.5No exploitEPSS 0%

    gfi · kerio connectMay 2, 2017

  • CVE-2025-34490
    26Monitor

    GFI MailEssentials < 21.8 XXE Arbitrary File Read

    MediumCVSS 6.5No exploitEPSS 0%

    gfi · mailessentialsApr 28, 2025

  • CVE-2026-23758
    25Monitor

    GFI HelpDesk < 4.99.9 Stored XSS via editsubject Parameter

    MediumCVSS 6.4No exploitEPSS 0%

    gfi · helpdeskApr 20, 2026

  • CVE-2019-16414
    24Monitor

    A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's clear

    MediumCVSS 6.1No exploitEPSS 1%

    gfi · kerio controlSep 30, 2019

  • CVE-2026-23621
    21Monitor

    GFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File Enumeration

    MediumCVSS 5.3No exploitEPSS 0%

    gfi · mailessentialsFeb 19, 2026