WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-693✕
Overview 21 matches · 3 in Waratek scope · 2 protected · 15 CISA KEV · 12 public PoC · 9 EPSS ≥ 0.5
21matches 3in Waratek scope14.3% 2protected9.5% 15CISA KEV71.4% 12public PoC57.1% 9EPSS ≥ 0.542.9%
Protected by Waratek 2 9.5% Rule in development 0 0.0% Mitigation candidate 1 4.8% No exploit published 0 0.0% Outside Waratek scope 3 14.3% Not applicable 15 71.4% Withdrawn CVE 0 0.0%
Critical 5 23.8% High 10 47.6% Medium 4 19.0% Low 2 9.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 9.5% partly blocked 0 0.0% not blocked 19 90.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 21 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 6 / year
Not applicable: 15Outside Waratek scope: 3Mitigation candidate: 1Protected by Waratek: 2 Low: 2Medium: 4High: 10Critical: 5 not blocked: 19blocked by ARMR today: 2 Exploited: 21
20132 Outside Waratek scope2 Critical1 Low1 not blocked2 Exploited2 20140 20150 20160 20170 20181 Not applicable1 Critical1 not blocked1 Exploited1 20193 Protected by Waratek2 Mitigation candidate1 Critical2 High1 blocked by ARMR today2 not blocked1 Exploited3 20200 20210 20221 Not applicable1 High1 not blocked1 Exploited1 20230 20246 Not applicable6 High3 Medium3 not blocked6 Exploited6 20252 Outside Waratek scope1 Not applicable1 High2 not blocked2 Exploited2 20266 Not applicable6 Critical1 High3 Medium1 Low1 not blocked6 Exploited6
2014201620182020202220242026
21 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-58704 High 2026-09-15 Not applicable Exploited In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-32202 Medium 2026-04-14 Not applicable Exploited Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-3965 Low 2026-03-12 Not applicable Exploited A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.20.2 is able to address this issue. The identifier of the patch is 6bec52dca158481258315ba0fc2f11206df7b719. It is advisable to upgrade the affected component. The code maintainer was informed beforehand about the issues. He reacted very fast and highly professional.
CVE-2026-21513 High 2026-02-10 Not applicable Exploited Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-21510 High 2026-02-10 Not applicable Exploited Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2025-40536 Critical 2026-01-28 Not applicable Exploited SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
CVE-2025-24061 High 2025-03-11 Not applicable Exploited Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally.
CVE-2025-0411 High 2025-01-25 Outside Waratek scope Exploited 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-25456.
CVE-2024-38226 High 2024-09-10 Not applicable Exploited Microsoft Publisher Security Feature Bypass Vulnerability
CVE-2024-38217 Medium 2024-09-10 Not applicable Exploited Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2024-38213 Medium 2024-08-13 Not applicable Exploited Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2024-29510 Medium 2024-07-03 Not applicable Exploited Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
CVE-2024-29988 High 2024-04-09 Not applicable Exploited SmartScreen Prompt Security Feature Bypass Vulnerability
CVE-2024-21412 High 2024-02-13 Not applicable Exploited Internet Shortcut Files Security Feature Bypass Vulnerability
CVE-2022-42848 High 2022-12-15 Not applicable Exploited A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2. An app may be able to execute arbitrary code with kernel privileges.
CVE-2019-1003030 Critical 2019-03-08 Protected by Waratek Exploited A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003029 Critical 2019-03-08 Protected by Waratek Exploited A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003000 High 2019-01-22 Mitigation candidate Exploited A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2017-3197 Critical 2018-07-09 Not applicable Exploited GIGABYTE BRIX UEFI firmware for the GB-BSi7H-6500 (version F6) and GB-BXi7-5775 (version F2) platforms does not securely implement BIOSWE, BLE, SMM_BWP, and PRx features. As a result, the BIOS is not protected from arbitrary write access and may permit modifications to the SPI flash.
CVE-2013-2465 Critical 2013-06-18 Outside Waratek scope Exploited Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
CVE-2013-0431 Low 2013-01-31 Outside Waratek scope Exploited Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.