Overview 6 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
6matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
1public PoC16.7%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
6
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
6
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
1
16.7%
Forecast only
0
0.0%
No public exploit
5
83.3%
split by
peak 3 / month
Jul 242
Not applicable2
Critical1
Medium1
not blocked2
Proof of concept only1
No public exploit1
Aug 240
Sep 240
Oct 240
Nov 240
Dec 240
Jan 250
Feb 250
Mar 250
Apr 250
May 250
Jun 250
Jul 251
Not applicable1
Medium1
not blocked1
No public exploit1
Aug 250
Sep 250
Oct 250
Nov 250
Dec 253
Not applicable3
High2
Medium1
not blocked3
No public exploit3
Aug 24Oct 24Dec 24Feb 25Apr 25Jun 25Aug 25Oct 25Dec 25
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-66200 | Medium | 2025-12-05 | Not applicable | No public exploit | mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue. |
| CVE-2025-58098 | High | 2025-12-05 | Not applicable | No public exploit | Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. |
| CVE-2025-55753 | High | 2025-12-05 | Not applicable | No public exploit | An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue. |
| CVE-2025-54090 | Medium | 2025-07-23 | Not applicable | No public exploit | A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue. |
| CVE-2024-40898 | Critical | 2024-07-18 | Not applicable | No public exploit | SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. |
| CVE-2024-40725 | Medium | 2024-07-18 | Not applicable | Proof of concept only | A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.62, which fixes this issue. |