WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕CWE CWE-367✕Has a public PoC✕
Overview 32 matches · 1 in Waratek scope · 0 protected · 7 exploited · 4 CISA KEV · 2 EPSS ≥ 0.5
32matches 1in Waratek scope3.1% 0protected0.0% 7exploited21.9% 4CISA KEV12.5% 2EPSS ≥ 0.56.2%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 3.1% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 31 96.9% Withdrawn CVE 0 0.0%
Critical 3 9.4% High 20 62.5% Medium 6 18.8% Low 3 9.4% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 32 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 7 21.9% Working exploit published 14 43.8% Proof of concept only 11 34.4% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 5 / year
Not applicable: 31Mitigation candidate: 1 Low: 3Medium: 6High: 20Critical: 3 not blocked: 32 Proof of concept only: 11Working exploit published: 14Exploited: 7
20041 Not applicable1 Medium1 not blocked1 Working exploit published1 20050 20060 20070 20080 20090 20100 20110 20120 20130 20140 20151 Not applicable1 High1 not blocked1 Exploited1 20160 20173 Not applicable3 High2 Medium1 not blocked3 Working exploit published3 20184 Not applicable4 High1 Medium1 Low2 not blocked4 Working exploit published4 20191 Not applicable1 High1 not blocked1 Working exploit published1 20204 Not applicable4 High2 Medium1 Low1 not blocked4 Exploited1 Working exploit published2 Proof of concept only1 20211 Not applicable1 High1 not blocked1 Proof of concept only1 20221 Not applicable1 Medium1 not blocked1 Exploited1 20232 Not applicable2 High2 not blocked2 Working exploit published1 Proof of concept only1 20245 Mitigation candidate1 Not applicable4 Critical2 High3 not blocked5 Exploited1 Working exploit published1 Proof of concept only3 20255 Not applicable5 Critical1 High4 not blocked5 Exploited2 Working exploit published1 Proof of concept only2 20264 Not applicable4 High3 Medium1 not blocked4 Exploited1 Proof of concept only3
200420062008201020122014201620182020202220242026
32 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-119977 High 2026-10-31 Not applicable Exploited WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
CVE-2026-83834 High 2026-10-13 Not applicable Proof of concept only Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVE-2026-41651 High 2026-04-22 Not applicable Proof of concept only PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as root, including executing RPM scriptlets, without authentication. The vulnerability is a TOCTOU race condition on `transaction->cached_transaction_flags` combined with a silent state-machine guard that discards illegal backward transitions while leaving corrupted flags in place. Three bugs exist in `src/pk-transaction.c`: 1. Unconditional flag overwrite (line 4036): `InstallFiles()` writes caller-supplied flags to `transaction->cached_transaction_flags` without checking whether the transaction has already been authorized/started. A second call blindly overwrites the flags even while the transaction is RUNNING. 2. Silent state-transition rejection (lines 873–882): `pk_transaction_set_state()` silently discards backward state transitions (e.g. `RUNNING` → `WAITING_FOR_AUTH`) but the flag overwrite at step 1 already happened. The transaction continues running with corrupted flags. 3. Late flag read at execution time (lines 2273–2277): The scheduler's idle callback reads cached_transaction_flags at dispatch time, not at authorization time. If flags were overwritten between authorization and execution, the backend sees the attacker's flags.
CVE-2026-1880 Medium 2026-04-16 Not applicable Proof of concept only An Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due to improper protection of required execution resources during the validation phase, permitting a local user to make unprivileged modifications. This allows the altered resource to pass system checks and be executed with elevated privileges upon a user-initiated update. Refer to the 'Security Update for ASUS DriverHub' section on the ASUS Security Advisory for more information.
CVE-2025-38352 High 2025-07-22 Not applicable Exploited In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
CVE-2025-49730 High 2025-07-08 Not applicable Working exploit published Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally.
CVE-2025-3464 High 2025-06-16 Not applicable Proof of concept only A race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leading to authentication bypass. Refer to the 'Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information.
CVE-2025-34027 Critical 2025-05-21 Not applicable Exploited The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to Time-of-Use (TOCTOU) write in combination with a race condition to achieve remote code execution via path loading manipulation, allowing an unauthenticated actor to achieve remote code execution (RCE).This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
CVE-2025-29969 High 2025-05-13 Not applicable Proof of concept only Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network.
CVE-2024-50379 Critical 2024-12-17 Mitigation candidate Proof of concept only Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
CVE-2024-0132 Critical 2024-09-26 Not applicable Working exploit published NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
CVE-2024-30088 High 2024-06-11 Not applicable Exploited Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-27327 High 2024-05-03 Not applicable Proof of concept only Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-18964.
CVE-2024-26218 High 2024-04-09 Not applicable Proof of concept only Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-38146 High 2023-09-12 Not applicable Working exploit published Windows Themes Remote Code Execution Vulnerability
CVE-2023-27470 High 2023-09-11 Not applicable Proof of concept only BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates, leading to arbitrary file deletion.
CVE-2022-3590 Medium 2022-12-14 Not applicable Exploited WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
CVE-2021-42835 High 2021-12-08 Not applicable Proof of concept only An issue was discovered in Plex Media Server through 1.24.4.5081-e362dc1ee. An attacker (with a foothold in a endpoint via a low-privileged user account) can access the exposed RPC service of the update service component. This RPC functionality allows the attacker to interact with the RPC functionality and execute code from a path of his choice (local, or remote via SMB) because of a TOCTOU race condition. This code execution is in the context of the Plex update service (which runs as SYSTEM).
CVE-2020-1337 High 2020-08-17 Not applicable Exploited An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.
CVE-2020-13162 High 2020-06-16 Not applicable Proof of concept only A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges.
CVE-2020-8793 Medium 2020-02-25 Not applicable Working exploit published OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.
CVE-2019-15126 Low 2020-02-05 Not applicable Working exploit published An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic, a different vulnerability than CVE-2019-9500, CVE-2019-9501, CVE-2019-9502, and CVE-2019-9503.
CVE-2019-0836 High 2019-04-09 Not applicable Working exploit published An elevation of privilege vulnerability exists when Windows improperly handles calls to the LUAFV driver (luafv.sys), aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0841.
CVE-2018-8584 High 2018-11-14 Not applicable Working exploit published An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers.
CVE-2018-8449 Low 2018-09-13 Not applicable Working exploit published A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
CVE-2018-1121 Medium 2018-06-13 Not applicable Working exploit published procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.
CVE-2018-0966 Low 2018-04-12 Not applicable Working exploit published A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
CVE-2017-11830 Medium 2017-11-15 Not applicable Working exploit published Device Guard in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows an attacker to make an unsigned file appear to be signed, due to a security feature bypass, aka "Device Guard Security Feature Bypass Vulnerability".
CVE-2017-0412 High 2017-02-08 Not applicable Working exploit published An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-33039926.
CVE-2017-0411 High 2017-02-08 Not applicable Working exploit published An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-33042690.
CVE-2015-3246 High 2015-08-11 Not applicable Exploited libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
CVE-2004-0594 Medium 2004-07-27 Not applicable Working exploit published The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.