WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-204✕
Overview 22 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
22matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 22 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 22 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 22 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 4 18.2% Forecast only 0 0.0% No public exploit 18 81.8%
split by peak 5 / quarter
Not applicable: 22 High: 22 not blocked: 22 No public exploit: 18Proof of concept only: 4
Q4 212 Not applicable2 High2 not blocked2 No public exploit2 Q1 220 Q2 220 Q3 220 Q4 220 Q1 230 Q2 230 Q3 230 Q4 230 Q1 241 Not applicable1 High1 not blocked1 Proof of concept only1 Q2 242 Not applicable2 High2 not blocked2 Proof of concept only1 No public exploit1 Q3 242 Not applicable2 High2 not blocked2 No public exploit2 Q4 240 Q1 251 Not applicable1 High1 not blocked1 No public exploit1 Q2 252 Not applicable2 High2 not blocked2 No public exploit2 Q3 251 Not applicable1 High1 not blocked1 No public exploit1 Q4 251 Not applicable1 High1 not blocked1 No public exploit1 Q1 260 Q2 261 Not applicable1 High1 not blocked1 No public exploit1 Q3 265 Not applicable5 High5 not blocked5 Proof of concept only1 No public exploit4 Q4 264 Not applicable4 High4 not blocked4 Proof of concept only1 No public exploit3
Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25Q4 25Q2 26Q4 26
22 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-123517 High 2026-11-08 Not applicable No public exploit Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.
CVE-2026-100164 High 2026-10-27 Not applicable No public exploit Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8.
CVE-2026-14177 High 2026-10-16 Not applicable No public exploit Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.
CVE-2026-104439 High 2026-10-02 Not applicable Proof of concept only YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.
CVE-2026-86758 High 2026-09-09 Not applicable No public exploit Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.
CVE-2026-19205 High 2026-09-04 Not applicable No public exploit Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026.
CVE-2026-19080 High 2026-09-04 Not applicable No public exploit Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menulux Portal: before 20260903211448.
CVE-2026-27462 High 2026-08-21 Not applicable Proof of concept only Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.
CVE-2026-69519 High 2026-08-20 Not applicable No public exploit Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.
CVE-2026-4113 High 2026-04-09 Not applicable No public exploit An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.
CVE-2025-61907 High 2025-10-16 Not applicable No public exploit Icinga 2 is an open source monitoring system. In Icinga 2 versions 2.4 through 2.15.0, filter expressions provided to the various /v1/objects endpoints could access variables or objects that would otherwise be inaccessible for the user. This allows authenticated API users to learn information that should be hidden from them, including global variables not permitted by the variables permission and objects not permitted by the corresponding objects/query permissions. The vulnerability is fixed in versions 2.15.1, 2.14.7, and 2.13.13.
CVE-2025-46390 High 2025-08-06 Not applicable No public exploit CWE-204: Observable Response Discrepancy
CVE-2025-3092 High 2025-06-24 Not applicable No public exploit An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint.
CVE-2025-5485 High 2025-06-12 Not applicable No public exploit User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequences.
CVE-2025-23193 High 2025-02-11 Not applicable No public exploit SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server availability.
CVE-2024-42343 High 2024-09-08 Not applicable No public exploit Loway - CWE-204: Observable Response Discrepancy
CVE-2024-38431 High 2024-07-30 Not applicable No public exploit Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy
CVE-2024-38322 High 2024-06-28 Not applicable No public exploit IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869.
CVE-2024-28232 High 2024-04-01 Not applicable Proof of concept only Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the login page which was patched in version 0.4.7. This issue in CVE-2024-28232 has been patched in version 0.4.8 but that version has not yet been uploaded to Go's package manager.
CVE-2024-24766 High 2024-03-06 Not applicable Proof of concept only CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumeration vulnerability in the login page. An attacker can enumerate the CasaOS username using the application response. If the username is incorrect application gives the error `**User does not exist**`. If the password is incorrect application gives the error `**Invalid password**`. Version 0.4.7 fixes this issue.
CVE-2021-20049 High 2021-12-23 Not applicable No public exploit A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions.
CVE-2021-34580 High 2021-10-27 Not applicable No public exploit In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.