CVEs we hold for Parallels
Records whose assigning authority named Parallels as the affected vendor. Newest identifiers first, capped at 200.
Announced together
One group of these records was published under a single advisory. Its page names that advisory, counts what the group offers, and says what it does not cover.
Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.
CVE-2026-90894Parallels Desktop local privilege escalation via appliance extract argument injectionParallels Desktop for Mac
CVE-2026-18263Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation VulnerabilityParallels RAS Client
CVE-2026-18262Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation VulnerabilityParallels RAS Client
CVE-2026-13121Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation VulnerabilityParallels RAS Client
CVE-2025-0413Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2024-6154Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2024-6153Parallels Desktop Updater Protection Mechanism Failure Software Downgrade VulnerabilityParallels Desktop
CVE-2023-50228Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2023-50227Parallels Desktop virtio-gpu Out-Of-Bounds Write Remote Code Execution VulnerabilityParallels Desktop
CVE-2023-50226Parallels Desktop Updater Link Following Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2023-27328Parallels Desktop Toolgate XML Injection Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2023-27327Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2023-27326Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2023-27325Parallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2023-27324Parallels Desktop Updater Improper Initialization Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2023-27323Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2023-27322Parallels Desktop Service Improper Initialization Local Privilege Escalation VulnerabilityParallels Desktop
CVE-2020-8968Parallels Remote Application Server credentials management errorsParallels Remote Application Server (Client)
84 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.