Overview 48 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
48matches
1in Waratek scope2.1%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
2.1%
Outside Waratek scope
1
2.1%
Not applicable
46
95.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
48
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
3
6.2%
Forecast only
0
0.0%
No public exploit
45
93.8%
split by
peak 13 / year
20191
Not applicable1
Low1
not blocked1
No public exploit1
20209
Not applicable9
Low9
not blocked9
No public exploit9
202110
Not applicable10
Low10
not blocked10
No public exploit10
20224
Not applicable4
Low4
not blocked4
No public exploit4
20233
Not applicable3
Low3
not blocked3
No public exploit3
202413
No exploit published1
Not applicable12
Low13
not blocked13
Proof of concept only1
No public exploit12
20253
Not applicable3
Low3
not blocked3
Proof of concept only2
No public exploit1
20265
Outside Waratek scope1
Not applicable4
Low5
not blocked5
No public exploit5
20192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-118568 | Low | 2026-10-30 | Not applicable | No public exploit | Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync (content-sync.io) allows Retrieve Embedded Sensitive Data. This issue affects Content Sync (content-sync.io) versions: from 0.0.0 to 3.2.2. |
| CVE-2026-118551 | Low | 2026-10-30 | Not applicable | No public exploit | Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. |
| CVE-2026-87951 | Low | 2026-10-22 | Not applicable | No public exploit | Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0. |
| CVE-2026-91477 | Low | 2026-10-20 | Outside Waratek scope | No public exploit | Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle JavaFX: 25.0.4 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle JavaFX. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle JavaFX accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). |
| CVE-2026-82153 | Low | 2026-10-14 | Not applicable | No public exploit | Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure. |
| CVE-2025-11645 | Low | 2025-10-12 | Not applicable | Proof of concept only | A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to launch the attack on the physical device. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-11644 | Low | 2025-10-12 | Not applicable | Proof of concept only | A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Executing manipulation can lead to insecure storage of sensitive information. The physical device can be targeted for the attack. This attack is characterized by high complexity. The exploitation is known to be difficult. The firmware versions determined to be affected are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-2157 | Low | 2025-03-15 | Not applicable | No public exploit | A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure and privilege escalation if exploited effectively. |
| CVE-2024-43427 | Low | 2024-11-11 | Not applicable | No public exploit | A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party. |
| CVE-2020-10368 | Low | 2024-11-10 | Not applicable | No public exploit | Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory read access via a "Spectra" attack. |
| CVE-2024-44222 | Low | 2024-10-28 | Not applicable | No public exploit | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to read sensitive location information. |
| CVE-2024-21211 | Low | 2024-10-15 | No exploit published | No public exploit | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM Enterprise Edition: 20.3.15 and 21.3.11. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). |
| CVE-2024-28808 | Low | 2024-09-30 | Not applicable | No public exploit | An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authenticated attacker to access reserved information by accessing undocumented web applications. |
| CVE-2024-40832 | Low | 2024-07-29 | Not applicable | No public exploit | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to view a contact's phone number in system logs. |
| CVE-2024-6295 | Low | 2024-06-25 | Not applicable | No public exploit | udn News Android APP stores the unencrypted user session in the local database when user log into the application. A malicious APP or an attacker with physical access to the Android device can retrieve this session and use it to log into the news APP and other services provided by udn. |
| CVE-2024-35311 | Low | 2024-05-29 | Not applicable | No public exploit | Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control. |
| CVE-2024-32236 | Low | 2024-04-25 | Not applicable | Proof of concept only | An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component. |
| CVE-2024-23232 | Low | 2024-03-08 | Not applicable | No public exploit | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4. An app may be able to capture a user's screen. |
| CVE-2023-37540 | Low | 2024-02-23 | Not applicable | No public exploit | Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data. |
| CVE-2024-0037 | Low | 2024-02-16 | Not applicable | No public exploit | In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2024-23217 | Low | 2024-01-23 | Not applicable | No public exploit | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6.5, watchOS 10.3. An app may be able to bypass certain Privacy preferences. |
| CVE-2023-26427 | Low | 2023-06-20 | Not applicable | No public exploit | Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known. |
| CVE-2023-23541 | Low | 2023-05-08 | Not applicable | No public exploit | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.4 and iPadOS 16.4. An app may be able to access information about a user’s contacts. |
| CVE-2022-39043 | Low | 2023-03-27 | Not applicable | No public exploit | Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts. |
| CVE-2022-33973 | Low | 2022-11-11 | Not applicable | No public exploit | Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user to potentially enable information disclosure via local access. |
| CVE-2022-32867 | Low | 2022-11-01 | Not applicable | No public exploit | This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. A user with physical access to an iOS device may be able to read past diagnostic logs. |
| CVE-2021-25266 | Low | 2022-04-27 | Not applicable | No public exploit | An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495. |
| CVE-2021-27456 | Low | 2022-03-23 | Not applicable | No public exploit | Philips Gemini PET/CT family software stores sensitive information in a removable media device that does not have built-in access control. |
| CVE-2020-4809 | Low | 2021-09-23 | Not applicable | No public exploit | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633. |
| CVE-2020-4805 | Low | 2021-09-23 | Not applicable | No public exploit | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539. |
| CVE-2020-4803 | Low | 2021-09-23 | Not applicable | No public exploit | IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535. |
| CVE-2021-25404 | Low | 2021-06-11 | Not applicable | No public exploit | Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log. |
| CVE-2021-25402 | Low | 2021-06-11 | Not applicable | No public exploit | Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information. |
| CVE-2021-20396 | Low | 2021-06-11 | Not applicable | No public exploit | IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 196009. |
| CVE-2021-20575 | Low | 2021-06-01 | Not applicable | No public exploit | IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. X-Force ID: 199278. |
| CVE-2020-4765 | Low | 2021-05-19 | Not applicable | No public exploit | IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 188902. |
| CVE-2021-20391 | Low | 2021-05-14 | Not applicable | No public exploit | IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 195999. |
| CVE-2020-4726 | Low | 2021-03-02 | Not applicable | No public exploit | The IBM Application Performance Monitoring UI (IBM Cloud APM 8.1.4) allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 187975. |
| CVE-2020-4906 | Low | 2020-12-16 | Not applicable | No public exploit | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally which can be read by another user on the system. |
| CVE-2019-19561 | Low | 2020-11-16 | Not applicable | No public exploit | A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular modem information. |
| CVE-2019-19557 | Low | 2020-11-16 | Not applicable | No public exploit | A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information. |
| CVE-2020-4886 | Low | 2020-11-13 | Not applicable | No public exploit | IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910. |
| CVE-2020-4650 | Low | 2020-11-09 | Not applicable | No public exploit | IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 186023. |
| CVE-2020-4344 | Low | 2020-09-15 | Not applicable | No public exploit | IBM Tivoli Business Service Manager 6.2.0.0 - 6.2.0.2 IF 1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 178247. |
| CVE-2019-4695 | Low | 2020-08-26 | Not applicable | No public exploit | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 171926. |
| CVE-2020-4371 | Low | 2020-07-22 | Not applicable | No public exploit | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. IBM X-Force ID: 179008. |
| CVE-2020-4197 | Low | 2020-03-03 | Not applicable | No public exploit | IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174908. |
| CVE-2019-4265 | Low | 2019-10-10 | Not applicable | No public exploit | IBM Maximo Anywhere 7.6.0, 7.6.1, 7.6.2, and 7.6.3 does not have device root detection which could result in an attacker gaining sensitive information about the device. IBM X-Force ID: 160198. |