Overview 86 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
86matches
1in Waratek scope1.2%
1protected1.2%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
1.2%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
85
98.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
1.2%
partly blocked
0
0.0%
not blocked
85
98.8%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
86
100.0%
split by
peak 19 / year
20021
Not applicable1
High1
not blocked1
No public exploit1
20031
Not applicable1
Medium1
not blocked1
No public exploit1
20040
20050
20060
20070
20080
20090
20100
20110
20120
20130
20140
20150
20160
20170
20183
Not applicable3
High1
Medium2
not blocked3
No public exploit3
20194
Not applicable4
High3
Medium1
not blocked4
No public exploit4
202012
Not applicable12
High11
Medium1
not blocked12
No public exploit12
202116
Not applicable16
High14
Medium2
not blocked16
No public exploit16
202219
Not applicable19
High18
Medium1
not blocked19
No public exploit19
20237
Protected by Waratek1
Not applicable6
High4
Medium3
blocked by ARMR today1
not blocked6
No public exploit7
202410
Not applicable10
High4
Medium6
not blocked10
No public exploit10
20254
Not applicable4
High1
Medium2
Low1
not blocked4
No public exploit4
20269
Not applicable9
High3
Medium6
not blocked9
No public exploit9
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-81352 | High | 2026-09-08 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. |
| CVE-2026-58600 | High | 2026-09-08 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-58599 | High | 2026-09-08 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally. |
| CVE-2026-20765 | Medium | 2026-08-11 | Not applicable | No public exploit | Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2026-20763 | Medium | 2026-08-11 | Not applicable | No public exploit | Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
| CVE-2025-15634 | Medium | 2026-05-09 | Not applicable | No public exploit | A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page. |
| CVE-2025-15633 | Medium | 2026-05-09 | Not applicable | No public exploit | An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers. |
| CVE-2026-40894 | Medium | 2026-04-23 | Not applicable | No public exploit | OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3. |
| CVE-2026-0671 | Medium | 2026-01-08 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - UploadWizard extension: 1.45, 1.44, 1.43, 1.39. |
| CVE-2025-68142 | Low | 2025-12-16 | Not applicable | No public exploit | PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption`). In systems that take unchecked user content, this could cause long hanges when processing the data if a malicious payload was crafted. This issue is patched in Release 10.16.1. As a workaround, those who process unknown user content without timeouts or other safeguards in place to prevent really large, malicious content being aimed at systems may avoid the use of `pymdownx.blocks.caption` until they're able to upgrade. |
| CVE-2024-13564 | Medium | 2025-02-22 | Not applicable | No public exploit | The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Writing Effect Headline shortcode in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2025-24695 | Medium | 2025-01-24 | Not applicable | No public exploit | Server-Side Request Forgery (SSRF) vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Server Side Request Forgery.This issue affects Extensions For CF7: from n/a through <= 3.2.0. |
| CVE-2024-13311 | High | 2025-01-09 | Not applicable | No public exploit | Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*. |
| CVE-2024-52471 | High | 2024-11-20 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor allows Reflected XSS.This issue affects Extensions for Elementor: from n/a through 2.0.37. |
| CVE-2024-39668 | Medium | 2024-08-01 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor allows Stored XSS.This issue affects Extensions for Elementor: from n/a through 2.0.31. |
| CVE-2024-37480 | Medium | 2024-07-21 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions apollo13-framework-extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.3. |
| CVE-2024-4868 | Medium | 2024-07-09 | Not applicable | No public exploit | The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's EE Events and EE Flipbox widgets in all versions up to, and including, 2.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-5504 | Medium | 2024-07-02 | Not applicable | No public exploit | The Rife Elementor Extensions & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' attribute within the plugin's Writing Effect Headline widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-5666 | Medium | 2024-06-29 | Not applicable | No public exploit | The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versions up to, and including, 2.0.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-29102 | High | 2024-03-19 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes Extensions For CF7 allows Stored XSS.This issue affects Extensions For CF7: from n/a through 3.0.6. |
| CVE-2024-24880 | Medium | 2024-02-08 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.2. |
| CVE-2024-21643 | High | 2024-01-10 | Not applicable | No public exploit | IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher. |
| CVE-2023-51539 | High | 2024-01-05 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.1. |
| CVE-2023-6836 | High | 2023-12-15 | Protected by Waratek | No public exploit | Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information. |
| CVE-2023-31074 | High | 2023-08-17 | Not applicable | No public exploit | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in hupe13 Extensions for Leaflet Map plugin <= 3.4.1 versions. |
| CVE-2023-38170 | High | 2023-08-08 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2023-36872 | Medium | 2023-07-11 | Not applicable | No public exploit | VP9 Video Extensions Information Disclosure Vulnerability |
| CVE-2023-36476 | High | 2023-06-29 | Not applicable | No public exploit | calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 and prior who installed NixOS through the graphical calamares installer, with an unencrypted `/boot`, on either non-UEFI systems or with a LUKS partition different from `/` have their LUKS key file in `/boot` as a plaintext CPIO archive attached to their NixOS initrd. A patch is available and anticipated to be part of version 0.3.13 to backport to NixOS 22.11, 23.05, and unstable channels. Expert users who have a copy of their data may, as a workaround, re-encrypt the LUKS partition(s) themselves. |
| CVE-2023-23899 | Medium | 2023-02-17 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Extensions For CF7 plugin <= 2.0.8 versions leads to arbitrary plugin activation. |
| CVE-2018-25065 | Medium | 2023-01-05 | Not applicable | No public exploit | A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTags_body.php of the component Unlike Parser. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is b4bc3cbbb099eab50cf2b544cf577116f1867b94. It is recommended to apply a patch to fix this issue. The identifier VDB-217445 was assigned to this vulnerability. |
| CVE-2022-30188 | High | 2022-06-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-29119 | High | 2022-06-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-29111 | High | 2022-06-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-22018 | High | 2022-06-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-33135 | Medium | 2022-05-12 | Not applicable | No public exploit | Uncontrolled resource consumption in the Linux kernel drivers for Intel(R) SGX may allow an authenticated user to potentially enable denial of service via local access. |
| CVE-2022-24532 | High | 2022-04-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24501 | High | 2022-03-09 | Not applicable | No public exploit | VP9 Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24456 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24453 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24452 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24451 | High | 2022-03-09 | Not applicable | No public exploit | VP9 Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-23301 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-22007 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-22006 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-22709 | High | 2022-02-09 | Not applicable | No public exploit | VP9 Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-21927 | High | 2022-02-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-21926 | High | 2022-02-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-21844 | High | 2022-02-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-21917 | High | 2022-01-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-43243 | Medium | 2021-12-15 | Not applicable | No public exploit | VP9 Video Extensions Information Disclosure Vulnerability |
| CVE-2021-41360 | High | 2021-12-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-40453 | High | 2021-12-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-40452 | High | 2021-12-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-38661 | High | 2021-09-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-33778 | High | 2021-07-14 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-33777 | High | 2021-07-14 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-33776 | High | 2021-07-14 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-33775 | High | 2021-07-14 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-31947 | High | 2021-07-14 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-31967 | High | 2021-06-08 | Not applicable | No public exploit | VP9 Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-28465 | High | 2021-05-11 | Not applicable | No public exploit | Web Media Extensions Remote Code Execution Vulnerability |
| CVE-2021-24265 | Medium | 2021-05-05 | Not applicable | No public exploit | The “Rife Elementor Extensions & Templates” WordPress Plugin before 1.1.6 has a widget that is vulnerable to stored Cross-Site Scripting(XSS) by lower-privileged users such as contributors, all via a similar method. |
| CVE-2021-28464 | High | 2021-04-13 | Not applicable | No public exploit | VP9 Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-1644 | High | 2021-01-12 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-1643 | High | 2021-01-12 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-8766 | Medium | 2020-11-12 | Not applicable | No public exploit | Improper conditions check in the Intel(R) SGX DCAP software before version 1.6 may allow an unauthenticated user to potentially enable denial of service via adjacent access. |
| CVE-2020-17110 | High | 2020-11-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-17109 | High | 2020-11-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-17108 | High | 2020-11-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-17107 | High | 2020-11-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-17106 | High | 2020-11-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-7668 | High | 2020-06-23 | Not applicable | No public exploit | In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide. |
| CVE-2020-7664 | High | 2020-06-23 | Not applicable | No public exploit | In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide. |
| CVE-2020-7663 | High | 2020-06-02 | Not applicable | No public exploit | websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. |
| CVE-2020-7662 | High | 2020-06-02 | Not applicable | No public exploit | websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. |
| CVE-2020-6236 | High | 2020-04-14 | Not applicable | No public exploit | SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including S-user ID bit s-bit) of arbitrary files remotely. This results in the possibility to execute these files as root user from a non-root context, leading to Privilege Escalation. |
| CVE-2020-0561 | High | 2020-02-13 | Not applicable | No public exploit | Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2019-14566 | High | 2019-11-14 | Not applicable | No public exploit | Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access. |
| CVE-2019-14565 | High | 2019-11-14 | Not applicable | No public exploit | Insufficient initialization in Intel(R) SGX SDK Windows versions 2.4.100.51291 and earlier, and Linux versions 2.6.100.51363 and earlier, may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access. |
| CVE-2019-0157 | Medium | 2019-06-13 | Not applicable | No public exploit | Insufficient input validation in the Intel(R) SGX driver for Linux may allow an authenticated user to potentially enable a denial of service via local access. |
| CVE-2019-0122 | High | 2019-03-14 | Not applicable | No public exploit | Double free in Intel(R) SGX SDK for Linux before version 2.2 and Intel(R) SGX SDK for Windows before version 2.1 may allow an authenticated user to potentially enable information disclosure or denial of service via local access. |
| CVE-2018-17060 | Medium | 2018-10-08 | Not applicable | No public exploit | Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory. NOTE: this product has been obsolete since June 2013. |
| CVE-2018-3689 | Medium | 2018-04-03 | Not applicable | No public exploit | AESM daemon in Intel Software Guard Extensions Platform Software Component for Linux before 2.1.102 can effectively be disabled by a local attacker creating a denial of services like remote attestation provided by the AESM. |
| CVE-2017-5736 | High | 2018-03-20 | Not applicable | No public exploit | An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to execute arbitrary code as administrator. |
| CVE-2003-0824 | Medium | 2003-12-15 | Not applicable | No public exploit | Unknown vulnerability in the SmartHTML interpreter (shtml.dll) in Microsoft FrontPage Server Extensions 2000 and 2002, and Microsoft SharePoint Team Services 2002, allows remote attackers to cause a denial of service (response failure) via a certain request. |
| CVE-2002-0692 | High | 2002-10-10 | Not applicable | No public exploit | Buffer overflow in SmartHTML Interpreter (shtml.dll) in Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to cause a denial of service (CPU consumption) or run arbitrary code, respectively, via a certain type of web file request. |