WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product connect✕
Overview 3,104 matches · 135 in Waratek scope · 18 protected · 81 exploited · 50 CISA KEV · 130 public PoC · 64 EPSS ≥ 0.5
3,104matches 135in Waratek scope4.3% 18protected0.6% 81exploited2.6% 50CISA KEV1.6% 130public PoC4.2% 64EPSS ≥ 0.52.1%
Protected by Waratek 18 0.6% Rule in development 0 0.0% Mitigation candidate 2 0.1% No exploit published 115 3.7% Outside Waratek scope 159 5.1% Not applicable 2,810 90.5% Withdrawn CVE 0 0.0%
Critical 372 12.0% High 1,536 49.5% Medium 1,117 36.0% Low 79 2.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 18 0.6% partly blocked 0 0.0% not blocked 3,086 99.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 81 2.6% Working exploit published 68 2.2% Proof of concept only 85 2.7% Forecast only 9 0.3% No public exploit 2,861 92.2%
split by peak 694 / year
Not applicable: 2,810Outside Waratek scope: 159No exploit published: 115Mitigation candidate: 2Protected by Waratek: 18 Low: 79Medium: 1,117High: 1,536Critical: 372 not blocked: 3,086blocked by ARMR today: 18 No public exploit: 2,861Forecast only: 9Proof of concept only: 85Working exploit published: 68Exploited: 81
20001 Not applicable1 Low1 not blocked1 No public exploit1 20011 Not applicable1 Low1 not blocked1 No public exploit1 20024 Outside Waratek scope3 Not applicable1 High2 Medium2 not blocked4 Working exploit published2 No public exploit2 20032 Not applicable2 Medium2 not blocked2 No public exploit2 200415 Outside Waratek scope2 Not applicable13 High8 Medium4 Low3 not blocked15 Working exploit published2 No public exploit13 200510 Outside Waratek scope1 Not applicable9 High7 Medium3 not blocked10 Working exploit published5 No public exploit5 200610 Not applicable10 High2 Medium8 not blocked10 Working exploit published4 No public exploit6 200723 Not applicable23 High15 Medium7 Low1 not blocked23 Working exploit published9 No public exploit14 200822 Outside Waratek scope1 Not applicable21 High13 Medium6 Low3 not blocked22 Working exploit published5 No public exploit17 20099 Not applicable9 High3 Medium6 not blocked9 Working exploit published4 No public exploit5 201023 Not applicable23 High4 Medium18 Low1 not blocked23 Working exploit published3 No public exploit20 201117 Not applicable17 High9 Medium7 Low1 not blocked17 Working exploit published2 No public exploit15 201222 Outside Waratek scope4 Not applicable18 High8 Medium13 Low1 not blocked22 Working exploit published2 No public exploit20 201341 Outside Waratek scope2 Not applicable39 High15 Medium23 Low3 not blocked41 Working exploit published2 No public exploit39 201425 Outside Waratek scope6 Not applicable19 High6 Medium18 Low1 not blocked25 Working exploit published1 No public exploit24 201547 Outside Waratek scope10 Not applicable37 Critical1 High16 Medium29 Low1 not blocked47 Exploited1 Working exploit published2 No public exploit44 201660 Outside Waratek scope5 Not applicable55 Critical2 High13 Medium39 Low6 not blocked60 Working exploit published1 Proof of concept only2 No public exploit57 201778 Protected by Waratek1 No exploit published3 Outside Waratek scope4 Not applicable70 Critical7 High27 Medium41 Low3 blocked by ARMR today1 not blocked77 Working exploit published6 Proof of concept only1 No public exploit71 2018108 No exploit published7 Outside Waratek scope19 Not applicable82 Critical17 High39 Medium51 Low1 not blocked108 Exploited5 Working exploit published2 No public exploit101 2019113 Protected by Waratek1 No exploit published5 Outside Waratek scope13 Not applicable94 Critical20 High36 Medium55 Low2 blocked by ARMR today1 not blocked112 Exploited5 Working exploit published4 Proof of concept only1 Forecast only2 No public exploit101 2020135 Protected by Waratek5 No exploit published6 Outside Waratek scope14 Not applicable110 Critical16 High44 Medium67 Low8 blocked by ARMR today5 not blocked130 Exploited8 Working exploit published1 Proof of concept only5 No public exploit121 2021215 Protected by Waratek3 Mitigation candidate1 No exploit published11 Outside Waratek scope14 Not applicable186 Critical31 High88 Medium92 Low4 blocked by ARMR today3 not blocked212 Exploited10 Working exploit published2 Proof of concept only5 Forecast only5 No public exploit193 2022283 Protected by Waratek3 No exploit published9 Outside Waratek scope12 Not applicable259 Critical42 High150 Medium86 Low5 blocked by ARMR today3 not blocked280 Exploited8 Working exploit published6 Proof of concept only20 Forecast only2 No public exploit247 2023313 Protected by Waratek3 Mitigation candidate1 No exploit published7 Outside Waratek scope3 Not applicable299 Critical52 High168 Medium92 Low1 blocked by ARMR today3 not blocked310 Exploited7 Working exploit published2 Proof of concept only26 No public exploit278 2024457 Protected by Waratek1 No exploit published5 Outside Waratek scope4 Not applicable447 Critical59 High297 Medium101 blocked by ARMR today1 not blocked456 Exploited16 Working exploit published1 Proof of concept only5 No public exploit435 2025376 Protected by Waratek1 No exploit published4 Outside Waratek scope8 Not applicable363 Critical24 High234 Medium111 Low7 blocked by ARMR today1 not blocked375 Exploited11 Proof of concept only20 No public exploit345 2026694 No exploit published58 Outside Waratek scope34 Not applicable602 Critical101 High332 Medium236 Low25 not blocked694 Exploited10 No public exploit684
200220052008201120142017202020232026
3,104 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 32 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-91212 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVE-2026-91211 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
CVE-2026-111357 High 2026-10-15 Not applicable Exploited Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
CVE-2026-104935 High 2026-10-13 Not applicable Exploited Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVE-2026-78341 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Unauthorized access.
CVE-2026-78340 Medium 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Filesystem access for attacker.
CVE-2026-78339 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, and Unauthorized access.
CVE-2026-78027 Medium 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.
CVE-2026-78026 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2026-78025 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, and Unauthorized access.
CVE-2026-78024 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, Server-side request forgery, and Unauthorized access.
CVE-2026-78023 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2026-78022 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
CVE-2026-78021 Medium 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Information exposure.
CVE-2026-78020 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote execution.
CVE-2026-78019 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Filesystem access for attacker, and Remote execution.
CVE-2026-78018 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
CVE-2026-78017 Low 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Protection mechanism bypass.
CVE-2026-78016 Medium 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure and Information tampering.
CVE-2026-78015 Medium 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.
CVE-2026-78013 Medium 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Protection mechanism bypass.
CVE-2026-76779 Critical 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypass, and Unauthorized access.
CVE-2026-76769 High 2026-10-09 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2026-87428 High 2026-10-08 Not applicable No public exploit In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches.
CVE-2026-87426 Medium 2026-10-08 Not applicable No public exploit An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.
CVE-2026-87425 High 2026-10-08 Not applicable No public exploit An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.
CVE-2026-87424 High 2026-10-08 Not applicable No public exploit A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.
CVE-2026-85490 High 2026-10-08 Not applicable No public exploit When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.
CVE-2026-85489 High 2026-10-08 Not applicable No public exploit An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.
CVE-2026-85488 High 2026-10-08 Not applicable No public exploit Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.
CVE-2026-85487 High 2026-10-08 Not applicable No public exploit A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.
CVE-2026-85486 High 2026-10-08 Not applicable No public exploit Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.
CVE-2026-85423 High 2026-10-08 Not applicable No public exploit A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning the appliance into an unauthenticated proxy or execution vector.
CVE-2026-85422 High 2026-10-08 Not applicable No public exploit A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored management credentials or craft forged administrative synchronization messages.
CVE-2026-85421 High 2026-10-08 Not applicable No public exploit A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states, and modify system configurations, leading to a complete compromise of the streaming service control plane.
CVE-2023-5649 Medium 2026-10-08 Not applicable No public exploit An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide invalid inputs like special characters leading to a Denial of Service (DoS) when collecting “supportsave” from a Brocade Switch.
CVE-2023-5648 Medium 2026-10-08 Not applicable No public exploit In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.
CVE-2026-57559 High 2026-10-06 Not applicable No public exploit Memory corruption while processing service requests.
CVE-2026-57555 High 2026-10-06 Not applicable No public exploit Memory Corruption when executing system service routines due to improper handling of user input buffers.
CVE-2026-57554 High 2026-10-06 Not applicable No public exploit Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
CVE-2026-57546 High 2026-10-06 Not applicable No public exploit Transient DOS when processing a continuous receive command with a zero-sized global configuration override.
CVE-2026-57545 High 2026-10-06 Not applicable No public exploit Memory corruption when processing draw objects of incorrect type during graphics command list execution.
CVE-2026-57537 High 2026-10-06 Not applicable No public exploit Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.
CVE-2026-25302 High 2026-10-06 Not applicable No public exploit Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
CVE-2026-25291 High 2026-10-06 Not applicable No public exploit Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms.
CVE-2026-25274 Medium 2026-10-06 Not applicable No public exploit Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
CVE-2026-25273 Medium 2026-10-06 Not applicable No public exploit Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.
CVE-2026-25272 Medium 2026-10-06 Not applicable No public exploit Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.
CVE-2026-25270 Medium 2026-10-06 Not applicable No public exploit Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
CVE-2026-25269 Medium 2026-10-06 Not applicable No public exploit Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.
CVE-2026-25267 High 2026-10-06 Not applicable No public exploit Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
CVE-2026-25263 Medium 2026-10-06 Not applicable No public exploit Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
CVE-2026-76114 Medium 2026-09-29 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVE-2026-73599 Medium 2026-09-29 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
CVE-2026-73598 High 2026-09-29 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
CVE-2026-73597 High 2026-09-29 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Launch of phishing attacks, and Protection mechanism bypass.
CVE-2026-73596 Medium 2026-09-29 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Information tampering, Protection mechanism bypass, and Unauthorized access.
CVE-2026-73595 Critical 2026-09-29 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Code execution, Information disclosure, Information tampering, and Protection mechanism bypass.
CVE-2026-73594 High 2026-09-29 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Protection mechanism bypass.
CVE-2026-73593 Medium 2026-09-29 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Active Debug Code vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access.
CVE-2026-73591 High 2026-09-23 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
CVE-2026-73589 Medium 2026-09-23 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access.
CVE-2026-73588 High 2026-09-23 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVE-2026-73587 Medium 2026-09-23 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Protection mechanism bypass.
CVE-2026-73586 Medium 2026-09-23 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypass, and Unauthorized access.
CVE-2026-71178 Low 2026-09-23 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVE-2026-71177 Medium 2026-09-23 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session theft.
CVE-2026-61413 Medium 2026-09-23 Not applicable No public exploit Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVE-2026-83964 High 2026-09-22 Not applicable No public exploit Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.
CVE-2026-75698 Critical 2026-09-22 Not applicable No public exploit Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVE-2026-75697 Critical 2026-09-22 Not applicable No public exploit Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVE-2026-75689 Critical 2026-09-22 Not applicable No public exploit Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVE-2026-75686 Critical 2026-09-22 Not applicable No public exploit Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVE-2026-75684 Critical 2026-09-22 Not applicable No public exploit Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
CVE-2026-75682 Critical 2026-09-22 Not applicable No public exploit Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-48361 Medium 2026-09-22 Not applicable No public exploit Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
CVE-2026-34689 High 2026-09-22 Not applicable No public exploit Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-25294 High 2026-09-17 Not applicable No public exploit Transient DOS while parsing frame during channel usage.
CVE-2026-25290 High 2026-09-17 Not applicable No public exploit Memory Corruption when validating large data buffers from external sources using addition to check buffer length.
CVE-2026-25284 High 2026-09-17 Not applicable No public exploit Information Disclosure when a pointer is reused after being deallocated.
CVE-2026-25283 High 2026-09-17 Not applicable No public exploit Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size.
CVE-2026-25282 High 2026-09-17 Not applicable No public exploit Transient DOS when processing unverified data from a neighboring system causes out of bound memory access.
CVE-2026-25281 High 2026-09-17 Not applicable No public exploit Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation.
CVE-2026-25280 High 2026-09-17 Not applicable No public exploit Memory corruption when processing escape handling flow with insufficient user buffer sizes.
CVE-2026-25275 High 2026-09-17 Not applicable No public exploit Transient DOS when processing authentication frames with invalid FILS information element header lengths.
CVE-2026-25261 High 2026-09-17 Not applicable No public exploit Memory corruption while processing rear sensor IOCTL calls.
CVE-2026-24081 High 2026-09-17 Not applicable No public exploit Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.
CVE-2026-24075 High 2026-09-17 Not applicable No public exploit Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.
CVE-2026-24074 High 2026-09-17 Not applicable No public exploit Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.
CVE-2026-24073 High 2026-09-17 Not applicable No public exploit Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.
CVE-2025-59607 High 2026-09-17 Not applicable No public exploit Memory Corruption when copying large input data exceeds normal allocation limits.
CVE-2026-76460 Critical 2026-09-16 Outside Waratek scope Exploited A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
CVE-2026-76451 Medium 2026-09-16 Outside Waratek scope No public exploit A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-76450 Medium 2026-09-16 Outside Waratek scope No public exploit A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-76449 Medium 2026-09-16 Outside Waratek scope No public exploit A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-76448 Medium 2026-09-16 Outside Waratek scope No public exploit A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.
CVE-2026-76447 Medium 2026-09-16 Outside Waratek scope No public exploit A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerability is due to missing authentication on a function of the OCSP responder. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to cause the OCSP responder to reload certificate and key material on demand.
CVE-2026-76446 Medium 2026-09-16 Outside Waratek scope No public exploit A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device. This vulnerability is due to improper restriction of XML external entity references. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read specific files on the affected system that the underlying process has permission to access.
CVE-2026-76444 Medium 2026-09-16 Outside Waratek scope No public exploit A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to missing authentication on the Policy Runtime Repository Table (PRRT) service. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to obtain sensitive configuration information from the affected device.
CVE-2026-76439 Medium 2026-09-16 Outside Waratek scope No public exploit A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE could allow an unauthenticated, remote attacker to submit forged posture status events into the endpoint posture pipeline. This vulnerability is due to insufficient authentication on an internal interface that is exposed through the guest portal. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to manipulate the posture status on the affected system.
‹ prev page 2 of 32 next ›