WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-400✕
Overview 19 matches · 3 in Waratek scope · 2 protected · 8 CISA KEV · 7 public PoC · 6 EPSS ≥ 0.5
19matches 3in Waratek scope15.8% 2protected10.5% 8CISA KEV42.1% 7public PoC36.8% 6EPSS ≥ 0.531.6%
Protected by Waratek 2 10.5% Rule in development 0 0.0% Mitigation candidate 1 5.3% No exploit published 0 0.0% Outside Waratek scope 1 5.3% Not applicable 15 78.9% Withdrawn CVE 0 0.0%
Critical 2 10.5% High 13 68.4% Medium 4 21.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 10.5% partly blocked 0 0.0% not blocked 17 89.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 19 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 5 / year
Not applicable: 15Outside Waratek scope: 1Mitigation candidate: 1Protected by Waratek: 2 Medium: 4High: 13Critical: 2 not blocked: 17blocked by ARMR today: 2 Exploited: 19
20041 Not applicable1 Medium1 not blocked1 Exploited1 20050 20060 20070 20080 20091 Not applicable1 Medium1 not blocked1 Exploited1 20100 20111 Not applicable1 High1 not blocked1 Exploited1 20120 20130 20140 20150 20160 20170 20181 Not applicable1 High1 not blocked1 Exploited1 20191 Not applicable1 High1 not blocked1 Exploited1 20203 Outside Waratek scope1 Not applicable2 High3 not blocked3 Exploited3 20211 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20220 20235 Protected by Waratek1 Mitigation candidate1 Not applicable3 High5 blocked by ARMR today1 not blocked4 Exploited5 20240 20251 Not applicable1 Medium1 not blocked1 Exploited1 20264 Not applicable4 Critical1 High2 Medium1 not blocked4 Exploited4
200420062008201020122014201620182020202220242026
19 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-55450 Critical 2026-06-23 Not applicable Exploited Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, which is an information leak that can assist in chaining other primitives. This vulnerability is fixed in 1.9.1.
CVE-2026-28318 High 2026-06-04 Not applicable Exploited SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
CVE-2026-45498 High 2026-05-20 Not applicable Exploited Microsoft Defender Denial of Service Vulnerability
CVE-2022-26523 Medium 2026-05-08 Not applicable Exploited The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) due to a double fetch vulnerability at aswArPot+0xbb94.
CVE-2025-61155 Medium 2025-10-28 Not applicable Exploited The GameDriverX64.sys kernel-mode anti-cheat driver (v7.23.4.7 and earlier) contains an access control vulnerability in one of its IOCTL handlers. A user-mode process can open a handle to the driver device and send specially crafted IOCTL requests. These requests are executed in kernel-mode context without proper authentication or access validation, allowing the attacker to terminate arbitrary processes, including critical system and security services, without requiring administrative privileges.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-38180 High 2023-08-08 Not applicable Exploited .NET and Visual Studio Denial of Service Vulnerability
CVE-2023-33297 High 2023-05-22 Not applicable Exploited Bitcoin Core before 24.1, when debug mode is not used, allows attackers to cause a denial of service (e.g., CPU consumption) because draining the inventory-to-send queue is inefficient, as exploited in the wild in May 2023.
CVE-2023-26464 High 2023-03-10 Protected by Waratek Exploited ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2023-23524 High 2023-02-27 Not applicable Exploited A denial-of-service issue was addressed with improved input validation. This issue is fixed in tvOS 16.3.2, iOS 16.3.1 and iPadOS 16.3.1, watchOS 9.3.1, macOS Ventura 13.2.1. Processing a maliciously crafted certificate may lead to a denial-of-service.
CVE-2021-44228 Critical 2021-12-10 Protected by Waratek Exploited Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVE-2020-3529 High 2020-10-21 Outside Waratek scope Exploited A vulnerability in the SSL VPN negotiation process for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to inefficient direct memory access (DMA) memory management during the negotiation phase of an SSL VPN connection. An attacker could exploit this vulnerability by sending a steady stream of crafted Datagram TLS (DTLS) traffic to an affected device. A successful exploit could allow the attacker to exhaust DMA memory on the device and cause a DoS condition.
CVE-2020-3569 High 2020-09-23 Not applicable Exploited Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. These vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address these vulnerabilities.
CVE-2020-3566 High 2020-08-29 Not applicable Exploited A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols. Cisco will release software updates that address this vulnerability.
CVE-2017-0938 High 2019-02-12 Not applicable Exploited Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.
CVE-2018-5391 High 2018-09-06 Not applicable Exploited The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability (CVE-2018-5391) became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.
CVE-2011-3192 High 2011-08-29 Not applicable Exploited The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
CVE-2009-2521 Medium 2009-09-04 Not applicable Exploited Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users to cause a denial of service (daemon crash) via a list (ls) -R command containing a wildcard that references a subdirectory, followed by a .. (dot dot), aka "IIS FTP Service DoS Vulnerability."
CVE-2004-1464 Medium 2004-12-31 Not applicable Exploited Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection to the Telnet or reverse Telnet port.