Overview 218 matches · 5 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
218matches
5in Waratek scope2.3%
2protected0.9%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
2
0.9%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
1.4%
Outside Waratek scope
3
1.4%
Not applicable
210
96.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
0.9%
partly blocked
0
0.0%
not blocked
216
99.1%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
218
100.0%
split by
peak 30 / year
19983
Not applicable3
High1
Medium2
not blocked3
No public exploit3
19993
Not applicable3
High1
Medium2
not blocked3
No public exploit3
20003
Not applicable3
Medium3
not blocked3
No public exploit3
200110
Not applicable10
High3
Medium6
Low1
not blocked10
No public exploit10
20028
Not applicable8
High2
Medium4
Low2
not blocked8
No public exploit8
20032
Not applicable2
Medium2
not blocked2
No public exploit2
20043
Not applicable3
High1
Medium2
not blocked3
No public exploit3
20055
Not applicable5
High2
Medium3
not blocked5
No public exploit5
20061
Not applicable1
High1
not blocked1
No public exploit1
20074
Not applicable4
High2
Medium2
not blocked4
No public exploit4
20084
Not applicable4
Medium4
not blocked4
No public exploit4
20091
Not applicable1
High1
not blocked1
No public exploit1
20105
Not applicable5
Medium5
not blocked5
No public exploit5
20110
20121
Not applicable1
Low1
not blocked1
No public exploit1
20132
Outside Waratek scope1
Not applicable1
Medium2
not blocked2
No public exploit2
20144
Not applicable4
Medium3
Low1
not blocked4
No public exploit4
201515
Not applicable15
Medium12
Low3
not blocked15
No public exploit15
20168
Not applicable8
High2
Medium6
not blocked8
No public exploit8
20177
Not applicable7
High1
Medium6
not blocked7
No public exploit7
201818
No exploit published1
Not applicable17
Critical5
High2
Medium11
not blocked18
No public exploit18
201915
No exploit published2
Outside Waratek scope1
Not applicable12
Critical2
High4
Medium9
not blocked15
No public exploit15
202012
Protected by Waratek2
Outside Waratek scope1
Not applicable9
Critical1
High5
Medium6
blocked by ARMR today2
not blocked10
No public exploit12
202111
Not applicable11
Critical3
High5
Medium3
not blocked11
No public exploit11
202213
Not applicable13
Critical3
High7
Medium3
not blocked13
No public exploit13
202319
Not applicable19
Critical1
High18
not blocked19
No public exploit19
20241
Not applicable1
High1
not blocked1
No public exploit1
202510
Not applicable10
High6
Medium4
not blocked10
No public exploit10
202630
Not applicable30
Critical3
High18
Medium9
not blocked30
No public exploit30
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-87696 | High | 2026-10-13 | Not applicable | No public exploit | Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-87695 | High | 2026-10-13 | Not applicable | No public exploit | Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-87692 | High | 2026-10-13 | Not applicable | No public exploit | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-96940 | High | 2026-10-02 | Not applicable | No public exploit | Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69641 | Critical | 2026-09-08 | Not applicable | No public exploit | Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69382 | Medium | 2026-09-08 | Not applicable | No public exploit | Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-69380 | High | 2026-09-08 | Not applicable | No public exploit | Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-69378 | High | 2026-09-08 | Not applicable | No public exploit | Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network. |
| CVE-2026-69375 | Medium | 2026-09-08 | Not applicable | No public exploit | Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. |
| CVE-2026-69361 | Medium | 2026-09-08 | Not applicable | No public exploit | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-69356 | Critical | 2026-09-08 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-69355 | High | 2026-09-08 | Not applicable | No public exploit | External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network. |
| CVE-2026-55007 | High | 2026-09-08 | Not applicable | No public exploit | Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-65813 | High | 2026-08-11 | Not applicable | No public exploit | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-62915 | Medium | 2026-08-11 | Not applicable | No public exploit | Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network. |
| CVE-2026-62914 | High | 2026-08-11 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-62913 | High | 2026-08-11 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network. |
| CVE-2026-62912 | Medium | 2026-08-11 | Not applicable | No public exploit | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network. |
| CVE-2026-62910 | High | 2026-08-11 | Not applicable | No public exploit | Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-55009 | High | 2026-07-14 | Not applicable | No public exploit | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-55008 | Critical | 2026-07-14 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-55006 | High | 2026-07-14 | Not applicable | No public exploit | Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
| CVE-2026-55005 | High | 2026-07-14 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network. |
| CVE-2026-47631 | High | 2026-06-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-45583 | High | 2026-06-09 | Not applicable | No public exploit | Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. |
| CVE-2026-45503 | High | 2026-06-09 | Not applicable | No public exploit | Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-45502 | Medium | 2026-06-09 | Not applicable | No public exploit | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network. |
| CVE-2026-45501 | Medium | 2026-06-09 | Not applicable | No public exploit | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-45500 | Medium | 2026-06-09 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-21527 | Medium | 2026-02-10 | Not applicable | No public exploit | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-64667 | Medium | 2025-12-09 | Not applicable | No public exploit | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-64666 | High | 2025-12-09 | Not applicable | No public exploit | Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2025-59249 | High | 2025-10-14 | Not applicable | No public exploit | Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2025-59248 | High | 2025-10-14 | Not applicable | No public exploit | Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-53782 | High | 2025-10-14 | Not applicable | No public exploit | Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally. |
| CVE-2025-33051 | High | 2025-08-12 | Not applicable | No public exploit | Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. |
| CVE-2025-25007 | Medium | 2025-08-12 | Not applicable | No public exploit | Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-25006 | Medium | 2025-08-12 | Not applicable | No public exploit | Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-25005 | Medium | 2025-08-12 | Not applicable | No public exploit | Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. |
| CVE-2025-53786 | High | 2025-08-06 | Not applicable | No public exploit | On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment. |
| CVE-2024-26198 | High | 2024-03-12 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-36439 | High | 2023-11-14 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-36050 | High | 2023-11-14 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-36778 | High | 2023-10-10 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-36757 | High | 2023-09-12 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-36756 | High | 2023-09-12 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-38185 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-38182 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-38181 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-35388 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-35368 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Remote Code Execution Vulnerability |
| CVE-2023-21709 | Critical | 2023-08-08 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2023-28310 | High | 2023-06-14 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-21710 | High | 2023-02-14 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-21706 | High | 2023-02-14 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2023-21764 | High | 2023-01-10 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2023-21763 | High | 2023-01-10 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2023-21762 | High | 2023-01-10 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2023-21761 | High | 2023-01-10 | Not applicable | No public exploit | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2023-21745 | High | 2023-01-10 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2022-41123 | High | 2022-11-09 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-41079 | High | 2022-11-09 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2022-41078 | High | 2022-11-09 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2022-34692 | Medium | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2022-30134 | Medium | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2022-24516 | High | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-24477 | High | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-21980 | High | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-21979 | Medium | 2022-08-09 | Not applicable | No public exploit | Microsoft Exchange Server Information Disclosure Vulnerability |
| CVE-2022-21978 | High | 2022-05-10 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2022-21969 | Critical | 2022-01-11 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2022-21855 | Critical | 2022-01-11 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2022-21846 | Critical | 2022-01-11 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2021-42305 | Medium | 2021-11-10 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2021-41350 | Medium | 2021-10-13 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2021-41348 | High | 2021-10-13 | Not applicable | No public exploit | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2021-34453 | High | 2021-10-13 | Not applicable | No public exploit | Microsoft Exchange Server Denial of Service Vulnerability |
| CVE-2021-26427 | Critical | 2021-10-13 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2021-31209 | High | 2021-05-11 | Not applicable | No public exploit | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2021-31198 | High | 2021-05-11 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2021-28483 | Critical | 2021-04-13 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2021-27078 | Critical | 2021-03-03 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2021-26854 | High | 2021-03-03 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2021-1730 | Medium | 2021-02-25 | Not applicable | No public exploit | <p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p> <p>This update addresses this vulnerability.</p> <p>To prevent these types of attacks, Microsoft recommends customers to download inline images from different DNSdomains than the rest of OWA. Please see further instructions in the FAQ to put in place this mitigations.</p> |
| CVE-2020-17142 | Critical | 2020-12-10 | Not applicable | No public exploit | Microsoft Exchange Remote Code Execution Vulnerability |
| CVE-2020-17141 | High | 2020-12-10 | Not applicable | No public exploit | Microsoft Exchange Remote Code Execution Vulnerability |
| CVE-2020-17117 | High | 2020-12-10 | Not applicable | No public exploit | Microsoft Exchange Remote Code Execution Vulnerability |
| CVE-2020-17085 | Medium | 2020-11-11 | Not applicable | No public exploit | Microsoft Exchange Server Denial of Service Vulnerability |
| CVE-2020-17084 | High | 2020-11-11 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2020-17083 | Medium | 2020-11-11 | Not applicable | No public exploit | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2020-16969 | High | 2020-10-16 | Not applicable | No public exploit | <p>An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.</p> <p>To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.</p> <p>The security update corrects the way that Exchange handles these token validations.</p> |
| CVE-2020-0543 | Medium | 2020-06-15 | Outside Waratek scope | No public exploit | Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. |
| CVE-2020-2830 | Medium | 2020-04-15 | Protected by Waratek | No public exploit | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). |
| CVE-2020-2781 | Medium | 2020-04-15 | Protected by Waratek | No public exploit | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). |
| CVE-2020-0903 | Medium | 2020-03-12 | Not applicable | No public exploit | A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'. |
| CVE-2020-0692 | High | 2020-02-11 | Not applicable | No public exploit | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. |
| CVE-2019-3641 | Medium | 2019-11-13 | No exploit published | No public exploit | Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages. |
| CVE-2019-1373 | Critical | 2019-11-12 | Not applicable | No public exploit | A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'. |
| CVE-2019-3738 | Medium | 2019-09-18 | No exploit published | No public exploit | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key. |
| CVE-2019-1266 | Medium | 2019-09-11 | Not applicable | No public exploit | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'. |