WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-307✕
Overview 11 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
11matches 1in Waratek scope9.1% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 9.1% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 10 90.9% Withdrawn CVE 0 0.0%
Critical 6 54.5% High 2 18.2% Medium 3 27.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 11 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 11 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 10Mitigation candidate: 1 Medium: 3High: 2Critical: 6 not blocked: 11 Working exploit published: 11
20012 Not applicable2 Critical2 not blocked2 Working exploit published2 20020 20030 20040 20050 20060 20070 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20180 20191 Not applicable1 Critical1 not blocked1 Working exploit published1 20203 Not applicable3 Critical1 High2 not blocked3 Working exploit published3 20210 20220 20232 Not applicable2 Critical1 Medium1 not blocked2 Working exploit published2 20240 20251 Not applicable1 Medium1 not blocked1 Working exploit published1 20262 Mitigation candidate1 Not applicable1 Critical1 Medium1 not blocked2 Working exploit published2
200220052008201120142017202020232026
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-62850 Medium 2026-11-06 Not applicable Working exploit published FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225.
CVE-2026-44596 Critical 2026-07-16 Mitigation candidate Working exploit published Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.
CVE-2025-52392 Medium 2025-08-13 Not applicable Working exploit published Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.
CVE-2022-30076 Medium 2023-04-16 Not applicable Working exploit published ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting.
CVE-2023-27100 Critical 2023-03-22 Not applicable Working exploit published Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.
CVE-2020-27423 High 2020-11-16 Not applicable Working exploit published Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox
CVE-2020-15906 Critical 2020-10-22 Not applicable Working exploit published tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.
CVE-2019-17525 High 2020-04-21 Not applicable Working exploit published The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.
CVE-2019-17240 Critical 2019-10-06 Not applicable Working exploit published bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.
CVE-2001-1291 Critical 2001-07-12 Not applicable Working exploit published The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, which makes it easier to break into the server via brute force password guessing.
CVE-2001-1339 Critical 2001-05-24 Not applicable Working exploit published Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct brute force password guessing attacks.