WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕EPSS ≥ 0.5✕Vendor checkpoint✕
Overview 7 matches · 0 in Waratek scope · 0 protected · 6 exploited · 6 CISA KEV · 6 public PoC
7matches 0in Waratek scope0.0% 0protected0.0% 6exploited85.7% 6CISA KEV85.7% 6public PoC85.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 14.3% Not applicable 6 85.7% Withdrawn CVE 0 0.0%
Critical 5 71.4% High 1 14.3% Medium 1 14.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 6 85.7% Working exploit published 0 0.0% Proof of concept only 1 14.3% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 6Outside Waratek scope: 1 Medium: 1High: 1Critical: 5 not blocked: 7 Proof of concept only: 1Exploited: 6
20142 Not applicable2 Critical2 not blocked2 Exploited2 20150 20160 20170 20180 20190 20200 20211 Outside Waratek scope1 Medium1 not blocked1 Proof of concept only1 20220 20230 20241 Not applicable1 High1 not blocked1 Exploited1 20250 20263 Not applicable3 Critical3 not blocked3 Exploited3
2014201620182020202220242026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-93616 Critical 2026-09-22 Not applicable Exploited A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
CVE-2026-85102 Critical 2026-09-09 Not applicable Exploited Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
CVE-2026-50751 Critical 2026-06-08 Not applicable Exploited A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
CVE-2024-24919 High 2024-05-28 Not applicable Exploited Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
CVE-2021-3449 Medium 2021-03-25 Outside Waratek scope Proof of concept only An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
CVE-2014-7169 Critical 2014-09-25 Not applicable Exploited GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
CVE-2014-6271 Critical 2014-09-24 Not applicable Exploited GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.