Overview 21 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
21matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
21
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
21
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
4
19.0%
Forecast only
0
0.0%
No public exploit
17
81.0%
split by
peak 7 / year
20191
Not applicable1
High1
not blocked1
No public exploit1
20200
20211
Not applicable1
High1
not blocked1
Proof of concept only1
20224
Not applicable4
High4
not blocked4
Proof of concept only1
No public exploit3
20232
Not applicable2
High2
not blocked2
No public exploit2
20244
Not applicable4
High4
not blocked4
Proof of concept only2
No public exploit2
20257
Not applicable7
High7
not blocked7
No public exploit7
20262
Not applicable2
High2
not blocked2
No public exploit2
20192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-58558 | High | 2026-07-15 | Not applicable | No public exploit | Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-1322 | High | 2026-05-14 | Not applicable | No public exploit | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization. |
| CVE-2025-54611 | High | 2025-08-06 | Not applicable | No public exploit | EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-54606 | High | 2025-08-06 | Not applicable | No public exploit | Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
| CVE-2025-2938 | High | 2025-06-26 | Not applicable | No public exploit | An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unintended permission grants. |
| CVE-2025-1908 | High | 2025-04-24 | Not applicable | No public exploit | An issue has been discovered in GitLab EE/CE that could allow an attacker to track users' browsing activities, potentially leading to full account take-over, affecting all versions from 16.6 before 17.9.7, 17.10 before 17.10.5, and 17.11 before 17.11.1. |
| CVE-2024-58043 | High | 2025-03-04 | Not applicable | No public exploit | Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-45424 | High | 2025-02-25 | Not applicable | No public exploit | Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access. |
| CVE-2024-56449 | High | 2025-01-08 | Not applicable | No public exploit | Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-54098 | High | 2024-12-12 | Not applicable | No public exploit | Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service integrity. |
| CVE-2024-51523 | High | 2024-11-05 | Not applicable | No public exploit | Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2024-1456 | High | 2024-04-16 | Not applicable | Proof of concept only | An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover. |
| CVE-2024-2267 | High | 2024-03-07 | Not applicable | Proof of concept only | A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0 and classified as problematic. This issue affects some unknown processing of the file /shop.php. The manipulation of the argument product_price leads to business logic errors. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256037 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2023-6514 | High | 2023-12-06 | Not applicable | No public exploit | The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions. Successful exploitation of this vulnerability may allow attackers to access restricted functions. |
| CVE-2023-6017 | High | 2023-11-16 | Not applicable | No public exploit | H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL. |
| CVE-2022-27782 | High | 2022-06-02 | Not applicable | Proof of concept only | libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily. |
| CVE-2022-0935 | High | 2022-04-07 | Not applicable | No public exploit | Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97. |
| CVE-2022-1155 | High | 2022-03-30 | Not applicable | No public exploit | Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10. |
| CVE-2022-0524 | High | 2022-02-08 | Not applicable | No public exploit | Business Logic Errors in GitHub repository publify/publify prior to 9.2.7. |
| CVE-2021-22926 | High | 2021-08-05 | Not applicable | Proof of concept only | libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake. |
| CVE-2019-3787 | High | 2019-06-19 | Not applicable | No public exploit | Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account. |