Skip to content
Noroxi

minio records

25 published records for vendor minio.

Researcher profile

Entered KEV
2 · 8%
Weaponized
2 · 8%
Pre-auth RCE
0
With a fix record
24%
Median publish → KEV
106 days

Records by year

  1. 18
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

25 records
  • CVE-2023-28432
    85Now

    Minio Information Disclosure in Cluster Deployment

    HighCVSS 7.5KEVWeaponizedEPSS 84%

    minio · minioMar 22, 2023

  • CVE-2023-28434
    67This week

    MinIO is vulnerable to privilege escalation on Linux/MacOS

    HighCVSS 8.8KEVWeaponizedEPSS 8%

    minio · minioMar 22, 2023

  • CVE-2021-43858
    46Plan

    User privilege escalation in MinIO

    HighCVSS 8.8Proof of conceptEPSS 35%

    minio · minioDec 27, 2021

  • CVE-2024-24747
    45Plan

    MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

    HighCVSS 8.8Proof of conceptEPSS 34%

    minio · minioJan 31, 2024

  • CVE-2021-21287
    37Monitor

    Server-Side Request Forgery in MinIO Browser API

    HighCVSS 7.7Proof of conceptEPSS 25%

    minio · minioFeb 1, 2021

  • CVE-2022-24842
    36Monitor

    Improper Privilege Management in MinIO

    HighCVSS 8.8No exploitEPSS 2%

    minio · minioApr 12, 2022

  • CVE-2026-33322
    36Monitor

    MinIO: JWT Algorithm Confusion in OIDC Authentication

    CriticalCVSS 9.2No exploitEPSS 1%

    minio · minioMar 24, 2026

  • CVE-2026-33419
    36Monitor

    MinIO: LDAP login brute-force via user enumeration and missing rate limit

    CriticalCVSS 9.1No exploitEPSS 1%

    minio · minioMar 24, 2026

  • CVE-2021-41137
    35Monitor

    Bypassing policy restrictions on regular users

    HighCVSS 8.8No exploitEPSS 1%

    minio · minioOct 13, 2021

  • CVE-2023-28433
    35Monitor

    Minio Privilege Escalation on Windows via Path separator manipulation

    HighCVSS 8.8No exploitEPSS 1%

    minio · minioMar 22, 2023

  • CVE-2023-25812
    35Monitor

    Allowed DELETE on resources on object locked buckets under Governance mode in Minio

    HighCVSS 8.8No exploitEPSS 1%

    minio · minioFeb 21, 2023

  • CVE-2026-40344
    35Monitor

    MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads

    HighCVSS 8.8No exploitEPSS 1%

    minio · minioApr 21, 2026

  • CVE-2026-41145
    35Monitor

    MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads

    HighCVSS 8.8No exploitEPSS 1%

    minio · minioApr 21, 2026

  • CVE-2022-31028
    31Monitor

    Possible DDOS by establishing keep-alive connections with anonymous HTTP clients in MinIO

    HighCVSS 7.5No exploitEPSS 3%

    minio · minioJun 7, 2022

  • CVE-2020-11012
    31Monitor

    Authentication bypass MinIO Admin API

    HighCVSS 7.5No exploitEPSS 2%

    minio · minioApr 23, 2020

  • CVE-2018-1000538
    30Monitor

    Minio Inc.

    HighCVSS 7.5No exploitEPSS 2%

    minio · minioJun 26, 2018

  • CVE-2026-39414
    28Monitor

    MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing

    HighCVSS 7.1No exploitEPSS 1%

    minio · minioApr 8, 2026

  • CVE-2026-34204
    28Monitor

    MinIO is Vulnerable to SSE Metadata Injection via Replication Headers

    HighCVSS 7.1No exploitEPSS 0%

    minio · minioMar 31, 2026

  • CVE-2026-42600
    27Monitor

    MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

    MediumCVSS 6.9No exploitEPSS 0%

    minio · minioMay 11, 2026

  • CVE-2021-21362
    26Monitor

    Bypassing readOnly policy by creating a temporary 'mc share upload' URL

    MediumCVSS 6.5No exploitEPSS 1%

    minio · minioMar 8, 2021

  • CVE-2023-27589
    26Monitor

    Minio vulnerable to denial of access by an admin privileged user for root credential

    MediumCVSS 6.5No exploitEPSS 1%

    minio · minioMar 14, 2023

  • CVE-2022-35919
    25Monitor

    Authenticated requests for server update admin API allows path traversal in minio

    LowCVSS 2.7Proof of conceptEPSS 51%

    minio · minioAug 1, 2022

  • CVE-2021-21390
    23Monitor

    MITM modification of request bodies in MinIO

    MediumCVSS 5.9No exploitEPSS 1%

    minio · minioMar 19, 2021

  • CVE-2023-33955
    21Monitor

    Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited

    MediumCVSS 5.3No exploitEPSS 1%

    minio · consoleMay 30, 2023

  • CVE-2024-36107
    21Monitor

    Information disclosure in minio

    MediumCVSS 5.3No exploitEPSS 1%

    minio · minioMay 28, 2024