Overview 279 matches · 5 in Waratek scope · 2 protected · 31 exploited · 20 CISA KEV · 43 public PoC · 36 EPSS ≥ 0.5
279matches
5in Waratek scope1.8%
2protected0.7%
31exploited11.1%
20CISA KEV7.2%
43public PoC15.4%
36EPSS ≥ 0.512.9%
Protected by Waratek
2
0.7%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
1.1%
Outside Waratek scope
3
1.1%
Not applicable
271
97.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
0.7%
partly blocked
0
0.0%
not blocked
277
99.3%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 33 / year
19984
Not applicable4
High2
Medium2
not blocked4
Working exploit published1
No public exploit3
19993
Not applicable3
High1
Medium2
not blocked3
No public exploit3
20003
Not applicable3
Medium3
not blocked3
No public exploit3
200110
Not applicable10
High3
Medium6
Low1
not blocked10
No public exploit10
20029
Not applicable9
High2
Medium5
Low2
not blocked9
Working exploit published1
No public exploit8
20033
Not applicable3
High1
Medium2
not blocked3
Working exploit published1
No public exploit2
20044
Not applicable4
High2
Medium2
not blocked4
Working exploit published1
No public exploit3
20057
Not applicable7
High3
Medium4
not blocked7
Working exploit published2
No public exploit5
20063
Not applicable3
High2
Low1
not blocked3
Working exploit published1
Forecast only1
No public exploit1
20075
Not applicable5
High3
Medium2
not blocked5
Working exploit published1
No public exploit4
20085
Not applicable5
Medium5
not blocked5
Working exploit published1
No public exploit4
20092
Not applicable2
High1
Medium1
not blocked2
Exploited1
No public exploit1
20106
Not applicable6
Medium6
not blocked6
Working exploit published1
No public exploit5
20110
20121
Not applicable1
Low1
not blocked1
No public exploit1
20132
Outside Waratek scope1
Not applicable1
Medium2
not blocked2
No public exploit2
20144
Not applicable4
Medium3
Low1
not blocked4
No public exploit4
201515
Not applicable15
Medium12
Low3
not blocked15
No public exploit15
20168
Not applicable8
High2
Medium6
not blocked8
No public exploit8
201711
Not applicable11
High2
Medium9
not blocked11
Exploited1
Working exploit published3
No public exploit7
201820
No exploit published1
Not applicable19
Critical5
High4
Medium11
not blocked20
Exploited2
No public exploit18
201915
No exploit published2
Outside Waratek scope1
Not applicable12
Critical2
High4
Medium9
not blocked15
No public exploit15
202017
Protected by Waratek2
Outside Waratek scope1
Not applicable14
Critical2
High9
Medium6
blocked by ARMR today2
not blocked15
Exploited3
Working exploit published1
Forecast only1
No public exploit12
202131
Not applicable31
Critical9
High16
Medium6
not blocked31
Exploited16
Working exploit published2
Proof of concept only2
No public exploit11
202218
Not applicable18
Critical4
High10
Medium4
not blocked18
Exploited4
Working exploit published1
No public exploit13
202327
Not applicable27
Critical1
High25
Medium1
not blocked27
Exploited2
Proof of concept only2
Forecast only4
No public exploit19
20243
Not applicable3
Critical1
High2
not blocked3
Exploited1
Proof of concept only1
No public exploit1
202510
Not applicable10
High6
Medium4
not blocked10
No public exploit10
202633
Not applicable33
Critical3
High21
Medium9
not blocked33
Exploited1
Proof of concept only2
No public exploit30
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-87696 | High | 2026-10-13 | Not applicable | No public exploit | Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-87695 | High | 2026-10-13 | Not applicable | No public exploit | Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-87692 | High | 2026-10-13 | Not applicable | No public exploit | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96940 | High | 2026-10-02 | Not applicable | No public exploit | Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69641 | Critical | 2026-09-08 | Not applicable | No public exploit | Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69382 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-69380 | High | 2026-09-08 | Not applicable | No public exploit | Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69378 | High | 2026-09-08 | Not applicable | No public exploit | Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69375 | Medium | 2026-09-08 | Not applicable | No public exploit | Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. |
| CVE-2026-69361 | Medium | 2026-09-08 | Not applicable | No public exploit | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-69356 | Critical | 2026-09-08 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-69355 | High | 2026-09-08 | Not applicable | No public exploit | External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network. |
| CVE-2026-55007 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-65813 | High | 2026-08-11 | Not applicable | No public exploit | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-62915 | Medium | 2026-08-11 | Not applicable | No public exploit | Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network. |
| CVE-2026-62914 | High | 2026-08-11 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-62913 | High | 2026-08-11 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network. |
| CVE-2026-62912 | Medium | 2026-08-11 | Not applicable | No public exploit | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network. |
| CVE-2026-62911 | High | 2026-08-11 | Not applicable | Proof of concept only | Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-62910 | High | 2026-08-11 | Not applicable | No public exploit | Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-55009 | High | 2026-07-14 | Not applicable | No public exploit | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-55008 | Critical | 2026-07-14 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-55006 | High | 2026-07-14 | Not applicable | No public exploit | Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-55005 | High | 2026-07-14 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network. |
| CVE-2026-47631 | High | 2026-06-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-45583 | High | 2026-06-09 | Not applicable | No public exploit | Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-45504 | High | 2026-06-09 | Not applicable | Proof of concept only | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-45503 | High | 2026-06-09 | Not applicable | No public exploit | Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-45502 | Medium | 2026-06-09 | Not applicable | No public exploit | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-45501 | Medium | 2026-06-09 | Not applicable | No public exploit | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-45500 | Medium | 2026-06-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-42897 | High | 2026-05-14 | Not applicable | Exploited | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-21527 | Medium | 2026-02-10 | Not applicable | No public exploit | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-64667 | Medium | 2025-12-09 | Not applicable | No public exploit | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-64666 | High | 2025-12-09 | Not applicable | No public exploit | Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2025-59249 | High | 2025-10-14 | Not applicable | No public exploit | Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2025-59248 | High | 2025-10-14 | Not applicable | No public exploit | Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-53782 | High | 2025-10-14 | Not applicable | No public exploit | Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally. |
| CVE-2025-33051 | High | 2025-08-12 | Not applicable | No public exploit | Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. |
| CVE-2025-25007 | Medium | 2025-08-12 | Not applicable | No public exploit | Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-25006 | Medium | 2025-08-12 | Not applicable | No public exploit | Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-25005 | Medium | 2025-08-12 | Not applicable | No public exploit | Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. |
| CVE-2025-53786 | High | 2025-08-06 | Not applicable | No public exploit | On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment. |
| CVE-2024-49040 | High | 2024-11-12 | Not applicable | Proof of concept only | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2024-26198 | High | 2024-03-12 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2024-21410 | Critical | 2024-02-13 | Not applicable | Exploited | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2023-36439 | High | 2023-11-14 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-36050 | High | 2023-11-14 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-36039 | High | 2023-11-14 | Not applicable | Forecast only | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-36035 | High | 2023-11-14 | Not applicable | Forecast only | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-36778 | High | 2023-10-10 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-36777 | Medium | 2023-09-12 | Not applicable | Forecast only | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2023-36757 | High | 2023-09-12 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-36756 | High | 2023-09-12 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-36745 | High | 2023-09-12 | Not applicable | Exploited | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-36744 | High | 2023-09-12 | Not applicable | Forecast only | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-38185 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-38182 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-38181 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-35388 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-35368 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Remote Code Execution Vulnerability |
| CVE-2023-21709 | Critical | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2023-32031 | High | 2023-06-14 | Not applicable | Proof of concept only | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-28310 | High | 2023-06-14 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-21710 | High | 2023-02-14 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-21707 | High | 2023-02-14 | Not applicable | Proof of concept only | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-21706 | High | 2023-02-14 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-21529 | High | 2023-02-14 | Not applicable | Exploited | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-21764 | High | 2023-01-10 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2023-21763 | High | 2023-01-10 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2023-21762 | High | 2023-01-10 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-21761 | High | 2023-01-10 | Not applicable | No public exploit | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2023-21745 | High | 2023-01-10 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2022-41123 | High | 2022-11-09 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-41080 | Critical | 2022-11-09 | Not applicable | Exploited | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-41079 | High | 2022-11-09 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2022-41078 | High | 2022-11-09 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2022-41082 | High | 2022-10-03 | Not applicable | Exploited | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2022-41040 | High | 2022-10-03 | Not applicable | Exploited | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-34692 | Medium | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2022-30134 | Medium | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2022-24516 | High | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-24477 | High | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-21980 | High | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-21979 | Medium | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2022-21978 | High | 2022-05-10 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-24463 | Medium | 2022-03-09 | Not applicable | Exploited | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2022-23277 | High | 2022-03-09 | Not applicable | Working exploit published | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2022-21969 | Critical | 2022-01-11 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2022-21855 | Critical | 2022-01-11 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2022-21846 | Critical | 2022-01-11 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2021-42321 | High | 2021-11-10 | Not applicable | Exploited | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2021-42305 | Medium | 2021-11-10 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2021-41349 | Medium | 2021-11-10 | Not applicable | Exploited | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2021-41350 | Medium | 2021-10-13 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2021-41348 | High | 2021-10-13 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2021-34453 | High | 2021-10-13 | Not applicable | No public exploit | Microsoft Exchange Server Denial of Service Vulnerability |
| CVE-2021-26427 | Critical | 2021-10-13 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2021-34523 | Critical | 2021-07-14 | Not applicable | Exploited | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2021-34473 | Critical | 2021-07-14 | Not applicable | Exploited | Microsoft Exchange Server Remote Code Execution Vulnerability |