WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕CWE CWE-307✕Has a public PoC✕
Overview 15 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
15matches 1in Waratek scope6.7% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 6.7% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 14 93.3% Withdrawn CVE 0 0.0%
Critical 8 53.3% High 4 26.7% Medium 3 20.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 15 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 11 73.3% Proof of concept only 4 26.7% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 5 / year
Not applicable: 14Mitigation candidate: 1 Medium: 3High: 4Critical: 8 not blocked: 15 Proof of concept only: 4Working exploit published: 11
20012 Not applicable2 Critical2 not blocked2 Working exploit published2 20020 20030 20040 20050 20060 20070 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20180 20191 Not applicable1 Critical1 not blocked1 Working exploit published1 20205 Not applicable5 Critical2 High3 not blocked5 Working exploit published3 Proof of concept only2 20210 20220 20234 Not applicable4 Critical2 High1 Medium1 not blocked4 Working exploit published2 Proof of concept only2 20240 20251 Not applicable1 Medium1 not blocked1 Working exploit published1 20262 Mitigation candidate1 Not applicable1 Critical1 Medium1 not blocked2 Working exploit published2
200220052008201120142017202020232026
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-62850 Medium 2026-11-06 Not applicable Working exploit published FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225.
CVE-2026-44596 Critical 2026-07-16 Mitigation candidate Working exploit published Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.
CVE-2025-52392 Medium 2025-08-13 Not applicable Working exploit published Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.
CVE-2022-30076 Medium 2023-04-16 Not applicable Working exploit published ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There is no rate limiting.
CVE-2023-27746 Critical 2023-04-13 Not applicable Proof of concept only BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force attack if the WPA2 handshake is intercepted.
CVE-2023-27100 Critical 2023-03-22 Not applicable Working exploit published Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.
CVE-2023-22960 High 2023-01-23 Not applicable Proof of concept only Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.
CVE-2020-35590 Critical 2020-12-21 Not applicable Proof of concept only LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.
CVE-2020-27423 High 2020-11-16 Not applicable Working exploit published Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox
CVE-2020-15906 Critical 2020-10-22 Not applicable Working exploit published tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.
CVE-2019-17525 High 2020-04-21 Not applicable Working exploit published The login page on D-Link DIR-615 T1 20.10 devices allows remote attackers to bypass the CAPTCHA protection mechanism and conduct brute-force attacks.
CVE-2020-11650 High 2020-04-08 Not applicable Proof of concept only An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1. It allows a denial of service. The login authentication component has no limits on the length of an authentication message or the rate at which such messages are sent.
CVE-2019-17240 Critical 2019-10-06 Not applicable Working exploit published bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.
CVE-2001-1291 Critical 2001-07-12 Not applicable Working exploit published The telnet server for 3Com hardware such as PS40 SuperStack II does not delay or disconnect remote attackers who provide an incorrect username or password, which makes it easier to break into the server via brute force password guessing.
CVE-2001-1339 Critical 2001-05-24 Not applicable Working exploit published Beck IPC GmbH IPC@CHIP telnet service does not delay or disconnect users from the service when bad passwords are entered, which makes it easier for remote attackers to conduct brute force password guessing attacks.