Cray develops specialized high-performance computing systems and operating environments including UNICOS, Cray Linux Environment, and UNICOS/MAX, a niche but strategically important segment of the computing landscape. The vendor's vulnerability profile is characterized by recurring input-validation weaknesses and frequently acquires public exploit tooling, reflecting the complexity of HPC system software and its operational exposure to security researchers. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cray over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-1999-0041HIGH Buffer overflow in NLS (Natural Language Service). | Feb 13, 1997 | 7.5 | 34 | NO | YES |
CVE-2003-0028HIGH Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc | Mar 25, 2003 | 7.5 | 28 | NO | NO |
CVE-1999-0099HIGH Buffer overflow in syslog utility allows local or remote attackers to gain root privileges. | Oct 19, 1995 | 10.0 | 28 | NO | NO |
CVE-2006-0177HIGH Multiple buffer overflows in Cray UNICOS 9.0.2.2 might allow local users to gain privileges by (1) invoking /usr/bin/script with a long command line argument or (2) setting the -c | Jan 11, 2006 | 7.2 | 27 | NO | YES |
CVE-1999-0692HIGH The default configuration of the Array Services daemon (arrayd) disables authentication, allowing remote users to gain root privileges. | Jul 19, 1999 | 10.0 | 25 | NO | NO |
CVE-2014-0748HIGH apinit on Cray devices with CLE before 4.2.UP02 and 5.x before 5.1.UP00 does not use alpsauth data to validate the UID in a launch message, which allows local users to gain privile | Dec 27, 2014 | 7.2 | 18 | NO | NO |
CVE-2006-0178HIGH Format string vulnerability in /bin/ftp in UNICOS 9.0.2.2 allows local users to have an unknown impact via format string specifiers in the quote command. NOTE: because the program | Jan 11, 2006 | 7.2 | 18 | NO | NO |
CVE-2001-0891HIGH Format string vulnerability in NQS daemon (nqsdaemon) in NQE 3.3.0.16 for CRAY UNICOS and SGI IRIX allows a local user to gain root privileges by using qsub to submit a batch job w | Jan 31, 2002 | 7.2 | 18 | NO | NO |
CVE-1999-1468MEDIUM rdist in various UNIX systems uses popen to execute sendmail, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable. | Oct 22, 1991 | 6.2 | 17 | NO | NO |
Vulnerability in accton in Cray UNICOS 6.1 and 6.0 allows local users to read arbitrary files and modify system accounting configuration. | Dec 31, 1999 | 3.6 | 13 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cray.
Media articles that mention a CVE ID that affects a product developed by Cray — matched by CVE ID, not by vendor name.