WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product tics✕
Overview 1,790 matches · 191 in Waratek scope · 39 protected · 59 exploited · 35 CISA KEV · 104 public PoC · 57 EPSS ≥ 0.5
1,790matches 191in Waratek scope10.7% 39protected2.2% 59exploited3.3% 35CISA KEV2.0% 104public PoC5.8% 57EPSS ≥ 0.53.2%
Protected by Waratek 39 2.2% Rule in development 0 0.0% Mitigation candidate 5 0.3% No exploit published 147 8.2% Outside Waratek scope 73 4.1% Not applicable 1,526 85.3% Withdrawn CVE 0 0.0%
Critical 186 10.4% High 852 47.6% Medium 727 40.6% Low 25 1.4% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 39 2.2% partly blocked 0 0.0% not blocked 1,751 97.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 59 3.3% Working exploit published 43 2.4% Proof of concept only 28 1.6% Forecast only 9 0.5% No public exploit 1,651 92.2%
split by peak 213 / year
Not applicable: 1,526Outside Waratek scope: 73No exploit published: 147Mitigation candidate: 5Protected by Waratek: 39 Low: 25Medium: 727High: 852Critical: 186 not blocked: 1,751blocked by ARMR today: 39 No public exploit: 1,651Forecast only: 9Proof of concept only: 28Working exploit published: 43Exploited: 59
19981 Not applicable1 High1 not blocked1 No public exploit1 19992 Not applicable2 High1 Medium1 not blocked2 Working exploit published1 No public exploit1 20002 Not applicable2 High2 not blocked2 Working exploit published2 20010 20020 20031 Not applicable1 High1 not blocked1 No public exploit1 20040 20052 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20066 Protected by Waratek1 No exploit published1 Not applicable4 High5 Medium1 blocked by ARMR today1 not blocked5 Working exploit published1 No public exploit5 20071 Not applicable1 Medium1 not blocked1 Working exploit published1 20088 Not applicable8 High5 Medium3 not blocked8 Working exploit published3 No public exploit5 20097 Not applicable7 High2 Medium5 not blocked7 Working exploit published1 No public exploit6 20106 Not applicable6 Medium6 not blocked6 Working exploit published5 No public exploit1 20116 Not applicable6 High1 Medium5 not blocked6 No public exploit6 20124 Not applicable4 Critical1 High2 Medium1 not blocked4 Working exploit published1 No public exploit3 201317 Protected by Waratek1 No exploit published5 Not applicable11 Critical1 High12 Medium4 blocked by ARMR today1 not blocked16 Exploited2 Working exploit published2 No public exploit13 201429 Protected by Waratek1 No exploit published2 Not applicable26 Critical2 High8 Medium17 Low2 blocked by ARMR today1 not blocked28 Exploited5 Working exploit published2 No public exploit22 201528 Protected by Waratek4 Not applicable24 Critical2 High7 Medium19 blocked by ARMR today4 not blocked24 Exploited4 Working exploit published3 No public exploit21 201625 Protected by Waratek1 Not applicable24 Critical3 High13 Medium8 Low1 blocked by ARMR today1 not blocked24 Exploited2 No public exploit23 201779 Protected by Waratek1 No exploit published11 Outside Waratek scope2 Not applicable65 Critical10 High29 Medium40 blocked by ARMR today1 not blocked78 Exploited1 Working exploit published3 Proof of concept only1 No public exploit74 2018125 Protected by Waratek4 No exploit published11 Outside Waratek scope10 Not applicable100 Critical13 High52 Medium59 Low1 blocked by ARMR today4 not blocked121 Exploited4 Working exploit published4 Proof of concept only1 Forecast only1 No public exploit115 2019186 Protected by Waratek9 No exploit published16 Outside Waratek scope12 Not applicable149 Critical27 High65 Medium89 Low5 blocked by ARMR today9 not blocked177 Exploited5 Working exploit published2 Proof of concept only4 Forecast only2 No public exploit173 2020130 Protected by Waratek1 Mitigation candidate2 No exploit published17 Outside Waratek scope4 Not applicable106 Critical12 High63 Medium52 Low3 blocked by ARMR today1 not blocked129 Exploited3 Proof of concept only1 No public exploit126 2021137 Protected by Waratek3 Mitigation candidate1 No exploit published16 Outside Waratek scope21 Not applicable96 Critical13 High65 Medium57 Low2 blocked by ARMR today3 not blocked134 Exploited12 Working exploit published3 Proof of concept only1 Forecast only1 No public exploit120 2022165 Protected by Waratek5 No exploit published10 Outside Waratek scope17 Not applicable133 Critical27 High67 Medium68 Low3 blocked by ARMR today5 not blocked160 Exploited6 Working exploit published6 Proof of concept only4 Forecast only4 No public exploit145 2023206 Protected by Waratek6 Mitigation candidate2 No exploit published19 Outside Waratek scope1 Not applicable178 Critical29 High115 Medium62 blocked by ARMR today6 not blocked200 Exploited13 Working exploit published2 Proof of concept only6 Forecast only1 No public exploit184 2024199 Protected by Waratek1 No exploit published12 Outside Waratek scope6 Not applicable180 Critical19 High123 Medium57 blocked by ARMR today1 not blocked198 Exploited1 Proof of concept only5 No public exploit193 2025205 No exploit published12 Not applicable193 Critical14 High116 Medium71 Low4 not blocked205 Working exploit published1 Proof of concept only2 No public exploit202 2026213 Protected by Waratek1 No exploit published15 Not applicable197 Critical13 High96 Medium100 Low4 blocked by ARMR today1 not blocked212 Exploited1 Proof of concept only3 No public exploit209
1999200220052008201120142017202020232026
1,790 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 18 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-56453 Critical 2026-07-16 Not applicable No public exploit HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to bypass controls and gain unauthorized access to targeted user accounts.
CVE-2026-35145 Low 2026-07-16 Not applicable No public exploit HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted connection (HTTP) and conduct man-in-the-middle (MitM) attacks. To remediate this, the application must include the "Strict-Transport-Security" header in all web application responses.
CVE-2026-35143 Medium 2026-07-16 Not applicable No public exploit HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.
CVE-2026-35142 High 2026-07-16 Not applicable No public exploit HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.
CVE-2026-35141 Medium 2026-07-16 Not applicable No public exploit HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access. To mitigate this risk, the application must implement a mechanism to include timestamps with every message, ensuring that messages exceeding a specific age threshold are automatically rejected by the recipient system.
CVE-2026-35140 High 2026-07-16 Not applicable No public exploit HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.
CVE-2026-15082 Medium 2026-07-10 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.
CVE-2026-46453 Medium 2026-07-06 No exploit published No public exploit Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-rest-client component reads several Exchange headers to control its behaviour - SEARCH_QUERY (an advanced query body), OPERATION (which Elasticsearch operation to run), INDEX_NAME, INDEX_SETTINGS and ID. The string values of these header constants, defined in ElasticSearchRestClientConstant, are plain unprefixed names ('SEARCH_QUERY', 'OPERATION', 'INDEX_NAME', 'INDEX_SETTINGS', 'ID') rather than the 'Camel'-prefixed names used by every other Camel component (for example CamelSqlQuery, CamelMongoDbCriteria, CamelCqlQuery). Camel's inbound HTTP header filter, HttpHeaderFilterStrategy, blocks only header names that begin with 'Camel' or 'camel'. Because the Elasticsearch header names do not carry that prefix, they pass through the inbound filter unchanged. When a Camel route exposes an HTTP entry point (for example platform-http) in front of an elasticsearch-rest-client producer, an untrusted HTTP client can set these headers directly on its request and override the query and operation that the route author configured: reading every document in the index (SEARCH_QUERY with a match_all query), deleting documents (OPERATION set to Delete together with ID), or exfiltrating selected fields. No credentials are required and the producer reads the headers unconditionally. This issue affects Apache Camel: from 4.3.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. The fix renames the camel-elasticsearch-rest-client Exchange header constant string values (ID, SEARCH_QUERY, INDEX_SETTINGS, INDEX_NAME, OPERATION) to carry the Camel prefix (CamelElasticsearchId, CamelElasticsearchSearchQuery, CamelElasticsearchIndexSettings, CamelElasticsearchIndexName, CamelElasticsearchOperation) so that they are blocked by the inbound HttpHeaderFilterStrategy; the Java field names are unchanged. For deployments that cannot upgrade immediately, strip the affected headers from untrusted inbound messages before they reach the producer (for example removeHeader('SEARCH_QUERY'), removeHeader('OPERATION'), removeHeader('INDEX_NAME'), removeHeader('INDEX_SETTINGS') and removeHeader('ID') in front of the elasticsearch-rest-client endpoint), or apply a custom HeaderFilterStrategy that blocks these names.
CVE-2026-56149 Medium 2026-07-01 Not applicable No public exploit Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted machine learning request that causes excessive memory consumption, which may render the affected node unavailable.
CVE-2026-56148 Medium 2026-07-01 Not applicable No public exploit Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.
CVE-2026-49090 Medium 2026-07-01 Not applicable No public exploit Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.
CVE-2026-47835 High 2026-06-15 No exploit published No public exploit In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8).
CVE-2026-24092 High 2026-06-01 Not applicable No public exploit Memory Corruption when processing fastboot commands to set display mode.
CVE-2026-24091 High 2026-06-01 Not applicable No public exploit Memory corruption while processing fastboot commands with improperly formatted input.
CVE-2026-24090 High 2026-06-01 Not applicable No public exploit Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.
CVE-2026-24089 High 2026-06-01 Not applicable No public exploit Memory corruption while processing fastboot commands with invalid input.
CVE-2026-24087 High 2026-06-01 Not applicable No public exploit Memory corruption while processing fastboot OEM commands.
CVE-2026-24085 High 2026-06-01 Not applicable No public exploit Memory Corruption when processing display command line information due to improper initialization of a variable.
CVE-2025-59610 Medium 2026-06-01 Not applicable No public exploit Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.
CVE-2025-59609 Medium 2026-06-01 Not applicable No public exploit Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.
CVE-2025-59605 High 2026-06-01 Not applicable No public exploit Memory Corruption when processing device identifier strings that exceed the expected maximum length.
CVE-2025-59604 High 2026-06-01 Not applicable No public exploit Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
CVE-2026-7365 High 2026-05-27 Not applicable No public exploit IBM Operations Analytics - Log Analysis  and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication.
CVE-2026-2255 Medium 2026-05-27 No exploit published No public exploit Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.
CVE-2026-2254 Medium 2026-05-27 No exploit published No public exploit Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs on certain API endpoints related to platform mail notfications.
CVE-2026-2253 High 2026-05-27 Protected by Waratek No public exploit Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.
CVE-2025-3633 High 2026-05-27 Not applicable No public exploit IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS). This vulnerability allows a remote attacker to inject arbitrary JavaScript code into the web user interface, which may alter the intended functionality and could lead to the disclosure of credentials within a trusted session.
CVE-2024-40684 Critical 2026-05-27 Not applicable No public exploit IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log Analysis does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
CVE-2025-36126 High 2026-05-26 Not applicable No public exploit IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2026-25193 High 2026-05-25 Not applicable No public exploit Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.
CVE-2026-42937 High 2026-05-13 Not applicable No public exploit Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42930 High 2026-05-13 Not applicable No public exploit When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42924 High 2026-05-13 Not applicable No public exploit An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42920 High 2026-05-13 Not applicable No public exploit When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42919 High 2026-05-13 Not applicable No public exploit A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42781 High 2026-05-13 Not applicable No public exploit When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42409 High 2026-05-13 Not applicable No public exploit When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42408 Medium 2026-05-13 Not applicable No public exploit When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42406 High 2026-05-13 Not applicable No public exploit A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42063 Medium 2026-05-13 Not applicable No public exploit A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42058 Medium 2026-05-13 Not applicable No public exploit An authenticated attacker's undisclosed requests to BIG-IP iControl REST can lead to an information leak of BIG-IP local user account names.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-41959 High 2026-05-13 Not applicable No public exploit Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-41957 High 2026-05-13 Not applicable No public exploit An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-41956 High 2026-05-13 Not applicable No public exploit When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-41954 Medium 2026-05-13 Not applicable No public exploit Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-41953 High 2026-05-13 Not applicable No public exploit A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-41225 High 2026-05-13 Not applicable No public exploit A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-41219 High 2026-05-13 Not applicable No public exploit An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2026-41218 High 2026-05-13 Not applicable No public exploit When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-41217 High 2026-05-13 Not applicable No public exploit A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-40703 Medium 2026-05-13 Not applicable No public exploit A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-40699 High 2026-05-13 Not applicable No public exploit A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-40698 High 2026-05-13 Not applicable No public exploit A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-40631 High 2026-05-13 Not applicable No public exploit An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-40629 High 2026-05-13 Not applicable No public exploit When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-40618 High 2026-05-13 Not applicable No public exploit When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-40462 High 2026-05-13 Not applicable No public exploit Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-40435 Medium 2026-05-13 Not applicable No public exploit When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-40423 High 2026-05-13 Not applicable No public exploit When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-39459 High 2026-05-13 Not applicable No public exploit A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-39458 High 2026-05-13 Not applicable No public exploit When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-39455 High 2026-05-13 Not applicable No public exploit When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-35062 High 2026-05-13 Not applicable No public exploit An authenticated iControl SOAP user may be able to obtain information of other accounts.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-34176 High 2026-05-13 Not applicable No public exploit When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-34019 Medium 2026-05-13 Not applicable No public exploit When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets and cause the configured routing protocol to fail over.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-32673 High 2026-05-13 Not applicable No public exploit A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-32643 High 2026-05-13 Not applicable No public exploit A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-24464 Medium 2026-05-13 Not applicable No public exploit When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-11159 Critical 2026-05-13 No exploit published No public exploit Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data source administrator.
CVE-2026-41018 Medium 2026-05-11 Not applicable No public exploit The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.
CVE-2025-59854 Medium 2026-05-06 Not applicable No public exploit HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, which could allow an attacker to exploit browser-specific rendering flaws or bypass security controls that should instead be managed by a robust Content Security Policy (CSP).
CVE-2025-59853 Medium 2026-05-06 Not applicable No public exploit HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an attacker to gain insights into the application's internal structure, code logic, and environment configurations.
CVE-2025-59852 Critical 2026-05-06 Not applicable No public exploit HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which could allow an attacker to compromise the confidentiality, integrity, and authentication of sensitive information.
CVE-2025-59851 Critical 2026-05-06 Not applicable No public exploit HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which could allow an attacker to identify and exploit publicly known security vulnerabilities to gain unauthorized access or compromise the application.
CVE-2025-31970 Medium 2026-05-06 Not applicable No public exploit HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for object-src and base-uri, which could allow an attacker to exploit injection vectors such as Cross-Site Scripting (XSS)
CVE-2026-24082 High 2026-05-04 Not applicable No public exploit Memory Corruption when copying data from a freed source while executing performance counter deselect operation.
CVE-2025-47404 High 2026-05-04 Not applicable No public exploit Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.
CVE-2025-47401 High 2026-05-04 Not applicable No public exploit Transient DOS when processing target power rate tables during channel configuration.
CVE-2026-40970 Medium 2026-04-27 No exploit published No public exploit When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.
CVE-2026-0827 Medium 2026-04-15 Not applicable Proof of concept only During an internal security assessment, a potential vulnerability was discovered in Lenovo Diagnostics and the HardwareScanAddin used in Lenovo Vantage that, during installation or when using hardware scan, could allow a local authenticated user to perform an arbitrary file write with elevated privileges.
CVE-2025-47392 High 2026-04-06 Not applicable No public exploit Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
CVE-2025-47389 High 2026-04-06 Not applicable No public exploit Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.
CVE-2026-5584 Medium 2026-04-05 Not applicable Proof of concept only A vulnerability has been found in Fosowl agenticSeek 0.1.0. Impacted is the function PyInterpreter.execute of the file sources/tools/PyInterpreter.py of the component query Endpoint. Such manipulation leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-3529 Medium 2026-03-26 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (XSS).This issue affects Google Analytics GA4: from 0.0.0 before 1.1.14.
CVE-2026-2072 High 2026-03-25 Not applicable No public exploit Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.
CVE-2026-1267 Medium 2026-03-17 Not applicable No public exploit IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls.
CVE-2025-14806 Medium 2026-03-17 Not applicable No public exploit IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.
CVE-2025-36105 Medium 2026-03-10 Not applicable No public exploit IBM Planning Analytics Advanced Certified Containers 3.1.0 through 3.1.4 could allow a local privileged user to obtain sensitive information from environment variables.
CVE-2025-11158 Critical 2026-03-10 No exploit published No public exploit Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.
CVE-2026-21385 High 2026-03-02 Not applicable Exploited Memory corruption while using alignments for memory allocation.
CVE-2025-47386 High 2026-03-02 Not applicable No public exploit Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
CVE-2025-47383 High 2026-03-02 Not applicable No public exploit Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
CVE-2025-47379 High 2026-03-02 Not applicable No public exploit Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.
CVE-2025-47377 High 2026-03-02 Not applicable No public exploit Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.
CVE-2025-47376 High 2026-03-02 Not applicable No public exploit Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.
CVE-2025-47375 High 2026-03-02 Not applicable No public exploit Memory corruption while handling different IOCTL calls from the user-space simultaneously.
CVE-2025-47371 Medium 2026-03-02 Not applicable No public exploit Transient DOS when an LTE RLC packet with invalid TB is received by UE.
CVE-2026-20732 Low 2026-02-04 Not applicable No public exploit A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-0947 Medium 2026-02-04 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1.
CVE-2025-47398 High 2026-02-02 Not applicable No public exploit Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.
‹ prev page 2 of 18 next ›