Overview 20 matches · 0 in Waratek scope · 0 protected · 17 exploited · 16 CISA KEV · 18 public PoC
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
20
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
20
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
17
85.0%
Working exploit published
1
5.0%
Proof of concept only
0
0.0%
Forecast only
2
10.0%
No public exploit
0
0.0%
split by
peak 4 / year
20081
Not applicable1
High1
not blocked1
Forecast only1
20090
20100
20111
Not applicable1
High1
not blocked1
Working exploit published1
20120
20130
20142
Not applicable2
Critical2
not blocked2
Exploited2
20150
20160
20171
Not applicable1
Critical1
not blocked1
Exploited1
20180
20194
Not applicable4
Critical3
High1
not blocked4
Exploited3
Forecast only1
20201
Not applicable1
Medium1
not blocked1
Exploited1
20211
Not applicable1
Critical1
not blocked1
Exploited1
20220
20234
Not applicable4
Critical3
Medium1
not blocked4
Exploited4
20241
Not applicable1
High1
not blocked1
Exploited1
20251
Not applicable1
Critical1
not blocked1
Exploited1
20263
Not applicable3
Critical3
not blocked3
Exploited3
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-88772 | Critical | 2026-09-27 | Not applicable | Exploited | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service |
| CVE-2026-88771 | Critical | 2026-09-27 | Not applicable | Exploited | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands. |
| CVE-2026-3055 | Critical | 2026-03-23 | Not applicable | Exploited | Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread |
| CVE-2025-5777 | Critical | 2025-06-17 | Not applicable | Exploited | Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server |
| CVE-2023-6549 | High | 2024-01-17 | Not applicable | Exploited | Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read |
| CVE-2023-4966 | Critical | 2023-10-10 | Not applicable | Exploited | Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. |
| CVE-2023-3519 | Critical | 2023-07-19 | Not applicable | Exploited | Unauthenticated remote code execution |
| CVE-2023-24489 | Critical | 2023-07-10 | Not applicable | Exploited | A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller. |
| CVE-2023-24488 | Medium | 2023-07-10 | Not applicable | Exploited | Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting |
| CVE-2021-22941 | Critical | 2021-09-23 | Not applicable | Exploited | Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller. |
| CVE-2020-8193 | Medium | 2020-07-10 | Not applicable | Exploited | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints. |
| CVE-2019-19781 | Critical | 2019-12-27 | Not applicable | Exploited | An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal. |
| CVE-2019-12991 | High | 2019-07-16 | Not applicable | Exploited | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6). |
| CVE-2019-12989 | Critical | 2019-07-16 | Not applicable | Exploited | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection. |
| CVE-2019-10883 | Critical | 2019-06-03 | Not applicable | Forecast only | Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection. |
| CVE-2017-6316 | Critical | 2017-07-20 | Not applicable | Exploited | Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID. |
| CVE-2014-7169 | Critical | 2014-09-25 | Not applicable | Exploited | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271. |
| CVE-2014-6271 | Critical | 2014-09-24 | Not applicable | Exploited | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix. |
| CVE-2011-2882 | High | 2011-07-21 | Not applicable | Working exploit published | Stack-based buffer overflow in the NSEPA.NsepaCtrl.1 ActiveX control in nsepa.ocx in Citrix Access Gateway Enterprise Edition 8.1 before 8.1-67.7, 9.0 before 9.0-70.5, and 9.1 before 9.1-96.4 allows remote attackers to execute arbitrary code via crafted HTTP header data. |
| CVE-2008-0356 | High | 2008-01-18 | Not applicable | Forecast only | Buffer overflow in the Independent Management Architecture (IMA) service in Citrix Presentation Server (MetaFrame Presentation Server) 4.5 and earlier, Access Essentials 2.0 and earlier, and Desktop Server 1.0 allows remote attackers to execute arbitrary code via an invalid size value in a packet to TCP port 2512 or 2513. |