Overview 5,239 matches · 0 in Waratek scope · 0 protected · 52 exploited · 3 CISA KEV · 759 public PoC · 85 EPSS ≥ 0.5
5,239matches
0in Waratek scope0.0%
0protected0.0%
52exploited1.0%
3CISA KEV0.1%
759public PoC14.5%
85EPSS ≥ 0.51.6%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
5,239
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
5,239
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 639 / year
19961
Not applicable1
Medium1
not blocked1
No public exploit1
19972
Not applicable2
High1
Medium1
not blocked2
No public exploit2
19981
Not applicable1
High1
not blocked1
No public exploit1
19996
Not applicable6
High6
not blocked6
Working exploit published2
No public exploit4
20002
Not applicable2
High2
not blocked2
Working exploit published2
20013
Not applicable3
High2
Medium1
not blocked3
Working exploit published1
No public exploit2
200230
Not applicable30
High11
Medium14
Low5
not blocked30
Working exploit published4
No public exploit26
200318
Not applicable18
High11
Medium6
Low1
not blocked18
Working exploit published5
No public exploit13
200419
Not applicable19
High10
Medium8
Low1
not blocked19
Working exploit published4
No public exploit15
200537
Not applicable37
High15
Medium19
Low3
not blocked37
Working exploit published7
No public exploit30
200650
Not applicable50
High24
Medium22
Low4
not blocked50
Working exploit published8
No public exploit42
2007208
Not applicable208
High72
Medium119
Low17
not blocked208
Exploited2
Working exploit published42
No public exploit164
2008404
Not applicable404
High191
Medium192
Low21
not blocked404
Exploited3
Working exploit published100
Proof of concept only1
No public exploit300
2009387
Not applicable387
High143
Medium225
Low19
not blocked387
Exploited4
Working exploit published183
No public exploit200
2010329
Not applicable329
High100
Medium192
Low37
not blocked329
Exploited2
Working exploit published50
Proof of concept only1
No public exploit276
2011233
Not applicable233
High74
Medium136
Low23
not blocked233
Exploited4
Working exploit published19
No public exploit210
2012552
Not applicable552
High117
Medium347
Low88
not blocked552
Exploited6
Working exploit published35
Proof of concept only1
Forecast only42
No public exploit468
2013523
Not applicable523
Critical1
High123
Medium320
Low79
not blocked523
Exploited7
Working exploit published27
No public exploit489
2014639
Not applicable639
High182
Medium375
Low82
not blocked639
Exploited7
Working exploit published46
Proof of concept only2
No public exploit584
2015507
Not applicable507
Critical6
High213
Medium255
Low33
not blocked507
Exploited5
Working exploit published75
Proof of concept only3
No public exploit424
2016600
Not applicable600
Critical39
High458
Medium89
Low14
not blocked600
Exploited7
Working exploit published55
Proof of concept only5
Forecast only1
No public exploit532
2017301
Not applicable301
Critical35
High211
Medium46
Low9
not blocked301
Exploited1
Working exploit published30
Proof of concept only2
No public exploit268
2018117
Not applicable117
Critical36
High65
Medium16
not blocked117
Working exploit published4
No public exploit113
201973
Not applicable73
Critical6
High44
Medium21
Low2
not blocked73
Working exploit published6
No public exploit67
202040
Not applicable40
Critical3
High23
Medium14
not blocked40
Working exploit published2
No public exploit38
202111
Not applicable11
Critical1
High3
Medium7
not blocked11
No public exploit11
202244
Not applicable44
Critical10
High20
Medium14
not blocked44
Exploited4
Proof of concept only2
No public exploit38
202314
Not applicable14
Critical2
High9
Medium3
not blocked14
Proof of concept only1
No public exploit13
202420
Not applicable20
Critical1
High8
Medium11
not blocked20
No public exploit20
202529
Not applicable29
High9
Medium18
Low2
not blocked29
Proof of concept only2
No public exploit27
202639
Not applicable39
Critical1
High5
Medium25
Low8
not blocked39
Proof of concept only5
No public exploit34
19961999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-101184 | Medium | 2026-11-02 | Not applicable | No public exploit | Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-101177 | Low | 2026-11-02 | Not applicable | No public exploit | Permission control vulnerability in the Optimizer module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-101176 | High | 2026-11-02 | Not applicable | No public exploit | Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-101172 | Medium | 2026-11-02 | Not applicable | No public exploit | Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality. |
| CVE-2026-101171 | Low | 2026-11-02 | Not applicable | No public exploit | Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect service integrity. |
| CVE-2026-116367 | Medium | 2026-10-26 | Not applicable | Proof of concept only | A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-96012 | Critical | 2026-10-12 | Not applicable | No public exploit | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system. |
| CVE-2026-108788 | Low | 2026-10-12 | Not applicable | No public exploit | A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-76488 | Medium | 2026-10-07 | Not applicable | No public exploit | A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient access control to file system resources. An attacker could exploit this vulnerability by submitting crafted values in specific UI fields. A successful exploit could allow the attacker to access sensitive files from the underlying file system of an affected device, including key materials that could be used to elevate privileges to root on the affected APIC and on managed switches. |
| CVE-2026-101102 | Medium | 2026-09-28 | Not applicable | No public exploit | A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function run_code of the component Code Mode Sandbox. The manipulation results in sandbox issue. The attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes all explicitly state the worker is "containment, not a security boundary". The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-76412 | High | 2026-09-16 | Not applicable | No public exploit | A vulnerability in the remote diagnostics debugger of Cisco Secure FMC Software could allow an authenticated, remote attacker to enable the remote diagnostics debugger service. This vulnerability is due to an error when checking the privilege level of a user who is invoking remote diagnostics. An attacker could exploit this vulnerability by authenticating to the device, either through the web-based management interface or the REST API, and using the remote diagnostics debugger to grant a user elevated privileges. A successful exploit could allow the attacker to elevate privileges to root. Notes: To exploit this vulnerability, the attacker must have valid user credentials on the affected device. The CVSSv3.1 Attack Complexity is High due to the multistage process required to fully exploit this vulnerability. |
| CVE-2026-81644 | Medium | 2026-09-09 | Not applicable | No public exploit | DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-49315 | High | 2026-09-09 | Not applicable | No public exploit | DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-49313 | Medium | 2026-09-09 | Not applicable | No public exploit | Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-49312 | Medium | 2026-09-09 | Not applicable | No public exploit | Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-49310 | High | 2026-09-09 | Not applicable | No public exploit | Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-49309 | Medium | 2026-09-09 | Not applicable | No public exploit | Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-41987 | Medium | 2026-09-09 | Not applicable | No public exploit | Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-49308 | Medium | 2026-08-17 | Not applicable | No public exploit | Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-49304 | Medium | 2026-08-17 | Not applicable | No public exploit | Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-49303 | Medium | 2026-08-17 | Not applicable | No public exploit | Permission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-18593 | Low | 2026-08-03 | Not applicable | Proof of concept only | A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotely. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-58556 | Medium | 2026-07-15 | Not applicable | No public exploit | Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-58555 | Medium | 2026-07-15 | Not applicable | No public exploit | Permission bypass vulnerability in the card module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-14784 | Medium | 2026-07-06 | Not applicable | No public exploit | A vulnerability was identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown function of the file backend/pkg/docker/client.go of the component Docker API. The manipulation leads to sandbox issue. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance. |
| CVE-2026-41974 | Low | 2026-06-09 | Not applicable | No public exploit | Permission control vulnerability in service notifications. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-9368 | Medium | 2026-05-24 | Not applicable | Proof of concept only | A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-41962 | Low | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in the app management and control module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-6878 | Low | 2026-04-23 | Not applicable | Proof of concept only | A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The manipulation leads to sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-6224 | Medium | 2026-04-13 | Not applicable | Proof of concept only | A security flaw has been discovered in nocobase plugin-workflow-javascript up to 2.0.23. This issue affects the function createSafeConsole of the file packages/plugins/@nocobase/plugin-workflow-javascript/src/server/Vm.js. Performing a manipulation results in sandbox issue. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-6117 | Low | 2026-04-12 | Not applicable | No public exploit | A vulnerability was found in AstrBotDevs AstrBot up to 4.22.1. This issue affects the function install_plugin_upload of the file astrbot/dashboard/routes/plugin.py of the component install-upload Endpoint. The manipulation of the argument File results in sandbox issue. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-20046 | High | 2026-03-11 | Not applicable | No public exploit | A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device. This vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by using the CLI command to bypass the task group–based checks. A successful exploit could allow the attacker to elevate privileges and perform actions on an affected device without authorization checks. |
| CVE-2026-28541 | Medium | 2026-03-05 | Not applicable | No public exploit | Permission control vulnerability in the cellular_data module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-66319 | Medium | 2026-03-05 | Not applicable | No public exploit | Permission control vulnerability in the resource scheduling module. Impact: Successful exploitation of this vulnerability may affect service integrity. |
| CVE-2026-24931 | Medium | 2026-02-06 | Not applicable | No public exploit | Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-24924 | Medium | 2026-02-06 | Not applicable | No public exploit | Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-24923 | Medium | 2026-02-06 | Not applicable | No public exploit | Permission control vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-24920 | Medium | 2026-02-06 | Not applicable | No public exploit | Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-68967 | Medium | 2026-01-14 | Not applicable | No public exploit | Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-66329 | Medium | 2025-12-08 | Not applicable | No public exploit | Permission control vulnerability in the window management module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-66325 | Medium | 2025-12-08 | Not applicable | No public exploit | Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-64315 | High | 2025-11-28 | Not applicable | No public exploit | Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data confidentiality and integrity. |
| CVE-2025-58315 | Medium | 2025-11-28 | Not applicable | No public exploit | Permission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-58312 | Medium | 2025-11-28 | Not applicable | No public exploit | Permission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-58309 | High | 2025-11-28 | Not applicable | No public exploit | Permission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
| CVE-2025-58302 | High | 2025-11-28 | Not applicable | No public exploit | Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-58294 | Medium | 2025-11-28 | Not applicable | No public exploit | Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-58293 | Medium | 2025-10-11 | Not applicable | No public exploit | Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-58285 | Medium | 2025-10-11 | Not applicable | No public exploit | Permission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-58284 | Medium | 2025-10-11 | Not applicable | No public exploit | Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-58283 | Medium | 2025-10-11 | Not applicable | No public exploit | Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-58282 | Medium | 2025-10-11 | Not applicable | No public exploit | Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-54654 | Medium | 2025-10-11 | Not applicable | No public exploit | Permission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentiality |
| CVE-2025-58276 | Medium | 2025-09-05 | Not applicable | No public exploit | Permission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-54608 | Medium | 2025-08-06 | Not applicable | No public exploit | Vulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: Successful exploitation of this vulnerability may cause device screen orientation to be arbitrarily set. |
| CVE-2025-53186 | Medium | 2025-07-07 | Not applicable | No public exploit | Vulnerability that allows third-party call apps to send broadcasts without verification in the audio framework module Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-53178 | Medium | 2025-07-07 | Not applicable | No public exploit | Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the schedule reminder function of head units. |
| CVE-2025-53177 | Low | 2025-07-07 | Not applicable | No public exploit | Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the schedule syncing function of watches. |
| CVE-2025-5874 | Low | 2025-06-09 | Not applicable | Proof of concept only | A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as problematic. This issue affects the function run_query of the file /query_runner/python.py of the component getattr Handler. The manipulation leads to sandbox issue. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he Python data source is disabled by default and is clearly marked in our documentation as discouraged due to its security implications. Users who choose to enable it are doing so at their own risk, with full awareness that it bypasses standard safeguards." |
| CVE-2025-48903 | High | 2025-06-06 | Not applicable | No public exploit | Permission bypass vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-5321 | Medium | 2025-05-29 | Not applicable | Proof of concept only | A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-46587 | Medium | 2025-05-06 | Not applicable | No public exploit | Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-20145 | Medium | 2025-03-12 | Not applicable | No public exploit | A vulnerability in the access control list (ACL) processing in the egress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability exists because certain packets are handled incorrectly when they are received on an ingress interface on one line card and destined out of an egress interface on another line card where the egress ACL is configured. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an egress ACL on the affected device. For more information about this vulnerability, see the section of this advisory. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. |
| CVE-2024-53011 | High | 2025-03-03 | Not applicable | No public exploit | Information disclosure may occur due to improper permission and access controls to Video Analytics engine. |
| CVE-2024-56444 | High | 2025-01-08 | Not applicable | No public exploit | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-56440 | High | 2025-01-08 | Not applicable | No public exploit | Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
| CVE-2023-52955 | High | 2025-01-08 | Not applicable | No public exploit | Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. |
| CVE-2024-43064 | High | 2025-01-06 | Not applicable | No public exploit | Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU. |
| CVE-2024-54104 | High | 2024-12-12 | Not applicable | No public exploit | Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-54103 | High | 2024-12-12 | Not applicable | No public exploit | Vulnerability of improper access control in the album module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2017-9711 | High | 2024-11-22 | Not applicable | No public exploit | Certain unprivileged processes are able to perform IOCTL calls. |
| CVE-2024-20371 | Medium | 2024-11-06 | Not applicable | No public exploit | A vulnerability in the access control list (ACL) programming of Cisco Nexus 3550-F Switches could allow an unauthenticated, remote attacker to send traffic that should be blocked to the management interface of an affected device. This vulnerability exists because ACL deny rules are not properly enforced at the time of device reboot. An attacker could exploit this vulnerability by attempting to send traffic to the management interface of an affected device. A successful exploit could allow the attacker to send traffic to the management interface of the affected device. |
| CVE-2024-51527 | Medium | 2024-11-05 | Not applicable | No public exploit | Permission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-51524 | Medium | 2024-11-05 | Not applicable | No public exploit | Permission control vulnerability in the Wi-Fi module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-20370 | Medium | 2024-10-23 | Not applicable | No public exploit | A vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to elevate their administrative privileges to root. The attacker would need valid administrative credentials on the device to exploit this vulnerability. This vulnerability exists because certain system configurations and executable files have insecure storage and permissions. An attacker could exploit this vulnerability by authenticating on the device and then performing a series of steps that includes downloading malicious system files and accessing the Cisco FXOS CLI to configure the attack. A successful exploit could allow the attacker to obtain root access on the device. |
| CVE-2024-45449 | Medium | 2024-09-04 | Not applicable | No public exploit | Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-45442 | High | 2024-09-04 | Not applicable | No public exploit | Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability will affect availability. |
| CVE-2023-7265 | Medium | 2024-08-08 | Not applicable | No public exploit | Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availability |
| CVE-2024-39670 | Medium | 2024-07-25 | Not applicable | No public exploit | Privilege escalation vulnerability in the account synchronisation module. Impact: Successful exploitation of this vulnerability will affect availability. |
| CVE-2024-21469 | High | 2024-07-01 | Not applicable | No public exploit | Memory corruption when an invoke call and a TEE call are bound for the same trusted application. |
| CVE-2024-5465 | Medium | 2024-06-14 | Not applicable | No public exploit | Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability. |
| CVE-2023-42005 | High | 2024-05-29 | Not applicable | No public exploit | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data 3.5, 4.0, 4.5, 4.6, 4.7, and 4.8 could allow a user with access to the Kubernetes pod, to make system calls compromising the security of containers. IBM X-Force ID: 265264. |
| CVE-2024-20361 | Medium | 2024-05-22 | Not applicable | No public exploit | A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass configured access controls on managed devices that are running Cisco Firepower Threat Defense (FTD) Software. This vulnerability is due to the incorrect deployment of the Object Groups for ACLs feature from Cisco FMC Software to managed FTD devices in high-availability setups. After an affected device is rebooted following Object Groups for ACLs deployment, an attacker can exploit this vulnerability by sending traffic through the affected device. A successful exploit could allow the attacker to bypass configured access controls and successfully send traffic to devices that are expected to be protected by the affected device. |
| CVE-2024-32996 | Medium | 2024-05-14 | Not applicable | No public exploit | Privilege escalation vulnerability in the account module Impact: Successful exploitation of this vulnerability will affect availability. |
| CVE-2023-52721 | Medium | 2024-05-14 | Not applicable | No public exploit | The WindowManager module has a vulnerability in permission control. Impact: Successful exploitation of this vulnerability may affect confidentiality. |
| CVE-2024-22452 | High | 2024-03-04 | Not applicable | No public exploit | Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access control vulnerability. A low privilege user could potentially exploit this vulnerability by modifying files in the installation folder to execute arbitrary code, leading to privilege escalation. |
| CVE-2023-44281 | High | 2024-01-24 | Not applicable | No public exploit | Dell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability. A low privilege user with local access to the system could potentially exploit this vulnerability to delete arbitrary files and result in Denial of Service. |
| CVE-2023-52106 | Critical | 2024-01-16 | Not applicable | No public exploit | Vulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Successful exploitation of this vulnerability will affect integrity and availability. |
| CVE-2023-20190 | Medium | 2023-09-13 | Not applicable | No public exploit | A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to incorrect destination address range encoding in the compression module of an ACL that is applied to an interface of an affected device. An attacker could exploit this vulnerability by sending traffic through the affected device that should be denied by the configured ACL. A successful exploit could allow the attacker to bypass configured ACL protections on the affected device, allowing the attacker to access trusted networks that the device might be protecting. There are workarounds that address this vulnerability. This advisory is part of the September 2023 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2023 Semiannual Cisco IOS XR Software Security Advisory Bundled Publication . |
| CVE-2023-39406 | High | 2023-08-13 | Not applicable | No public exploit | Permission control vulnerability in the XLayout component. Successful exploitation of this vulnerability may cause apps to forcibly restart. |
| CVE-2023-39394 | High | 2023-08-13 | Not applicable | No public exploit | Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may cause the arp list to be modified. |
| CVE-2023-39391 | High | 2023-08-13 | Not applicable | No public exploit | Vulnerability of system file information leakage in the USB Service module. Successful exploitation of this vulnerability may affect confidentiality. |
| CVE-2023-39387 | Medium | 2023-08-13 | Not applicable | No public exploit | Vulnerability of permission control in the window management module. Successful exploitation of this vulnerability may cause malicious pop-up windows. |
| CVE-2023-39384 | High | 2023-08-13 | Not applicable | No public exploit | Vulnerability of incomplete permission verification in the input method module. Successful exploitation of this vulnerability may cause features to perform abnormally. |
| CVE-2023-39380 | High | 2023-08-13 | Not applicable | No public exploit | Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnormally. |
| CVE-2023-3599 | Critical | 2023-07-10 | Not applicable | No public exploit | A vulnerability was found in SourceCodester Best Fee Management System 1.0. It has been rated as critical. Affected by this issue is the function save_user of the file admin_class.php of the component Add User Handler. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-233450 is the identifier assigned to this vulnerability. |
| CVE-2022-48508 | High | 2023-07-06 | Not applicable | No public exploit | Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity. |
| CVE-2023-21641 | High | 2023-07-04 | Not applicable | No public exploit | An app with non-privileged access can change global system brightness and cause undesired system behavior. |
| CVE-2023-22633 | High | 2023-06-13 | Not applicable | No public exploit | An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions 8.7.0 all versions may allow an unauthenticated attacker to perform a DoS attack on the device via client-secure renegotiation. |
| CVE-2022-36246 | Critical | 2023-05-30 | Not applicable | No public exploit | Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions. |