WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-295✕
Overview 10 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
10matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.510.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 10 100.0% Withdrawn CVE 0 0.0%
Critical 2 20.0% High 4 40.0% Medium 4 40.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 10 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 10 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 10 Medium: 4High: 4Critical: 2 not blocked: 10 Working exploit published: 10
20021 Not applicable1 Medium1 not blocked1 Working exploit published1 20030 20040 20050 20060 20070 20080 20090 20100 20110 20120 20130 20140 20150 20160 20173 Not applicable3 Critical1 High1 Medium1 not blocked3 Working exploit published3 20182 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20190 20201 Not applicable1 Medium1 not blocked1 Working exploit published1 20210 20220 20231 Not applicable1 Critical1 not blocked1 Working exploit published1 20241 Not applicable1 High1 not blocked1 Working exploit published1 20250 20261 Not applicable1 High1 not blocked1 Working exploit published1
2002200420062008201020122014201620182020202220242026
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-25961 High 2026-02-09 Not applicable Working exploit published SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid TLS certificate (e.g., Let's Encrypt) can intercept the update check request, inject a malicious installer URL, and achieve arbitrary code execution.
CVE-2024-51774 High 2024-11-02 Not applicable Working exploit published qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.
CVE-2023-27823 Critical 2023-05-12 Not applicable Working exploit published An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.
CVE-2012-1096 Medium 2020-03-10 Not applicable Working exploit published NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection.
CVE-2018-6221 High 2018-03-15 Not applicable Working exploit published An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an update file and inject their own.
CVE-2018-6219 Medium 2018-03-15 Not applicable Working exploit published An Insecure Update via HTTP vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to eavesdrop and tamper with certain types of update data.
CVE-2016-1252 Medium 2017-12-05 Not applicable Working exploit published The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
CVE-2017-2800 Critical 2017-05-24 Not applicable Working exploit published A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution. In order to trigger this vulnerability, the attacker needs to supply a malicious x509 certificate to either a server or a client application using this library.
CVE-2017-3563 High 2017-04-24 Not applicable Working exploit published Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.0.38 and Prior to 5.1.20. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2002-0862 Medium 2002-10-04 Not applicable Working exploit published The (1) CertGetCertificateChain, (2) CertVerifyCertificateChainPolicy, and (3) WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints of intermediate CA-signed X.509 certificates, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack for SSL sessions, as originally reported for Internet Explorer and IIS.