WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product ion✕
Overview 23,725 matches · 3,172 in Waratek scope · 406 protected · 529 exploited · 289 CISA KEV · 1,802 public PoC · 605 EPSS ≥ 0.5
split by peak 2,249 / year
Withdrawn CVE: 1Not applicable: 19,102Outside Waratek scope: 1,450No exploit published: 2,686Mitigation candidate: 78Protected by Waratek: 408 Unknown: 1None: 2Low: 1,140Medium: 10,757High: 9,333Critical: 2,492 not established: 2not blocked: 23,315partly blocked: 2blocked by ARMR today: 406 No public exploit: 20,454Forecast only: 137Proof of concept only: 1,268Working exploit published: 1,337Exploited: 529
19962 Not applicable2 High2 not blocked2 Working exploit published2 19973 Not applicable3 High1 Medium2 not blocked3 Working exploit published2 No public exploit1 19985 Not applicable5 High3 Medium2 not blocked5 Working exploit published2 No public exploit3 199942 No exploit published1 Not applicable41 High19 Medium20 Low3 not blocked42 Exploited1 Working exploit published15 No public exploit26 200051 Mitigation candidate1 No exploit published1 Outside Waratek scope1 Not applicable48 High19 Medium27 Low5 not blocked51 Exploited2 Working exploit published26 No public exploit23 200167 Protected by Waratek1 Mitigation candidate1 No exploit published5 Outside Waratek scope2 Not applicable58 High37 Medium27 Low3 blocked by ARMR today1 not blocked66 Exploited3 Working exploit published16 Forecast only1 No public exploit47 2002110 Protected by Waratek1 No exploit published14 Outside Waratek scope6 Not applicable89 High45 Medium59 Low6 blocked by ARMR today1 not blocked109 Exploited2 Working exploit published23 Forecast only8 No public exploit77 200365 No exploit published3 Not applicable62 Critical1 High23 Medium37 Low4 not blocked65 Exploited2 Working exploit published20 No public exploit43 2004133 Protected by Waratek1 Mitigation candidate1 No exploit published5 Outside Waratek scope5 Not applicable121 Critical1 High63 Medium60 Low9 blocked by ARMR today1 not blocked132 Working exploit published38 No public exploit95 2005281 Mitigation candidate1 No exploit published18 Outside Waratek scope1 Not applicable261 Critical2 High124 Medium141 Low14 not blocked281 Exploited1 Working exploit published87 Forecast only2 No public exploit191 2006300 Protected by Waratek2 Mitigation candidate1 No exploit published51 Outside Waratek scope11 Not applicable235 High128 Medium152 Low20 blocked by ARMR today2 not blocked298 Working exploit published90 No public exploit210 2007365 Protected by Waratek2 Mitigation candidate1 No exploit published49 Outside Waratek scope11 Not applicable302 Critical1 High197 Medium147 Low20 blocked by ARMR today2 not blocked363 Exploited3 Working exploit published87 Forecast only1 No public exploit274 2008368 Mitigation candidate2 No exploit published34 Outside Waratek scope27 Not applicable305 Critical1 High199 Medium155 Low13 not blocked368 Exploited1 Working exploit published94 Forecast only5 No public exploit268 2009385 Protected by Waratek1 Mitigation candidate1 No exploit published64 Outside Waratek scope10 Not applicable309 Critical1 High187 Medium173 Low24 blocked by ARMR today1 not blocked384 Exploited9 Working exploit published113 Forecast only2 No public exploit261 2010305 Protected by Waratek5 Mitigation candidate2 No exploit published49 Outside Waratek scope19 Not applicable230 Critical4 High118 Medium142 Low41 blocked by ARMR today5 not blocked300 Exploited9 Working exploit published63 No public exploit233 2011291 Protected by Waratek1 Mitigation candidate4 No exploit published59 Outside Waratek scope24 Not applicable203 High96 Medium168 Low27 blocked by ARMR today1 not blocked290 Exploited3 Working exploit published40 Proof of concept only1 No public exploit247 2012503 Protected by Waratek3 Mitigation candidate10 No exploit published93 Outside Waratek scope15 Not applicable382 Critical6 High161 Medium275 Low61 blocked by ARMR today3 not blocked498 not established2 Exploited15 Working exploit published65 Proof of concept only1 Forecast only8 No public exploit414 2013613 Protected by Waratek5 Mitigation candidate4 No exploit published95 Outside Waratek scope40 Not applicable469 Critical10 High176 Medium343 Low84 blocked by ARMR today5 not blocked608 Exploited20 Working exploit published42 Forecast only3 No public exploit548 2014855 Protected by Waratek8 Mitigation candidate4 No exploit published111 Outside Waratek scope63 Not applicable669 Critical13 High184 Medium544 Low114 blocked by ARMR today8 not blocked847 Exploited14 Working exploit published54 Proof of concept only1 Forecast only3 No public exploit783 2015741 Protected by Waratek2 Mitigation candidate6 No exploit published102 Outside Waratek scope45 Not applicable586 Critical18 High217 Medium413 Low93 blocked by ARMR today2 not blocked739 Exploited17 Working exploit published50 Proof of concept only2 Forecast only2 No public exploit670 2016768 Protected by Waratek20 Mitigation candidate2 No exploit published106 Outside Waratek scope23 Not applicable617 Critical97 High294 Medium340 Low37 blocked by ARMR today20 not blocked748 Exploited22 Working exploit published58 Proof of concept only2 Forecast only11 No public exploit675 20171,212 Protected by Waratek29 Mitigation candidate2 No exploit published91 Outside Waratek scope88 Not applicable1,002 Critical176 High462 Medium555 Low19 blocked by ARMR today27 partly blocked2 not blocked1,183 Exploited30 Working exploit published84 Proof of concept only3 Forecast only1 No public exploit1,094 20181,868 Protected by Waratek62 Mitigation candidate2 No exploit published136 Outside Waratek scope170 Not applicable1,498 Critical299 High683 Medium866 Low20 blocked by ARMR today62 not blocked1,806 Exploited30 Working exploit published91 Proof of concept only6 Forecast only4 No public exploit1,737 20191,623 Protected by Waratek54 Mitigation candidate2 No exploit published135 Outside Waratek scope227 Not applicable1,205 Critical236 High563 Medium776 Low48 blocked by ARMR today54 not blocked1,569 Exploited34 Working exploit published47 Proof of concept only13 Forecast only11 No public exploit1,518 20201,603 Protected by Waratek57 Mitigation candidate8 No exploit published227 Outside Waratek scope206 Not applicable1,105 Critical184 High597 Medium754 Low68 blocked by ARMR today57 not blocked1,546 Exploited38 Working exploit published30 Proof of concept only17 Forecast only10 No public exploit1,508 20211,766 Protected by Waratek44 Mitigation candidate12 No exploit published164 Outside Waratek scope175 Not applicable1,371 Critical205 High764 Medium750 Low47 blocked by ARMR today44 not blocked1,722 Exploited51 Working exploit published31 Proof of concept only30 Forecast only23 No public exploit1,631 20221,920 Protected by Waratek41 Mitigation candidate5 No exploit published155 Outside Waratek scope130 Not applicable1,589 Critical234 High852 Medium764 Low70 blocked by ARMR today41 not blocked1,879 Exploited44 Working exploit published17 Proof of concept only151 Forecast only22 No public exploit1,686 20231,881 Protected by Waratek22 Mitigation candidate4 No exploit published100 Outside Waratek scope47 Not applicable1,708 Critical283 High845 Medium730 Low23 blocked by ARMR today22 not blocked1,859 Exploited50 Working exploit published20 Proof of concept only210 Forecast only10 No public exploit1,591 20241,686 Protected by Waratek11 Mitigation candidate1 No exploit published87 Outside Waratek scope62 Not applicable1,525 Critical207 High636 Medium802 Low41 blocked by ARMR today11 not blocked1,675 Exploited49 Working exploit published11 Proof of concept only266 Forecast only8 No public exploit1,352 20251,664 Protected by Waratek7 Mitigation candidate1 No exploit published86 Outside Waratek scope16 Not applicable1,553 Withdrawn CVE1 Critical207 High575 Medium778 Low101 None2 Unknown1 blocked by ARMR today7 not blocked1,657 Exploited46 Working exploit published15 Proof of concept only437 Forecast only2 No public exploit1,164 20262,249 Protected by Waratek29 No exploit published645 Outside Waratek scope26 Not applicable1,549 Critical306 High1,063 Medium755 Low125 blocked by ARMR today29 not blocked2,220 Exploited33 Working exploit published4 Proof of concept only128 No public exploit2,084
19961999200220052008201120142017202020232026
23,725 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 238 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-101764 Medium 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-101763 Critical 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Communications BRM - Elastic Charging Engine. Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101759 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-101742 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101566 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101552 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101551 High 2026-10-20 No exploit published No public exploit Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-110806 Medium 2026-10-16 Not applicable No public exploit Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
CVE-2026-110805 Low 2026-10-16 Not applicable No public exploit Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
CVE-2026-110804 Medium 2026-10-16 Not applicable No public exploit Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
CVE-2026-110287 Medium 2026-10-16 Not applicable No public exploit Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
CVE-2026-44084 High 2026-10-15 Not applicable No public exploit An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-34015 High 2026-10-15 Not applicable No public exploit A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-26245 High 2026-10-15 Not applicable No public exploit A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-26244 High 2026-10-15 Not applicable No public exploit A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVE-2026-24723 Medium 2026-10-15 Not applicable No public exploit A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
CVE-2026-24722 Medium 2026-10-15 Not applicable No public exploit A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
CVE-2026-24721 Medium 2026-10-15 Not applicable No public exploit A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later
CVE-2025-66275 High 2026-10-15 Not applicable No public exploit A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
CVE-2025-66272 High 2026-10-15 Not applicable No public exploit A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.5 and later
CVE-2026-96943 High 2026-10-13 Not applicable No public exploit Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
CVE-2026-95696 High 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
CVE-2026-95695 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
CVE-2026-93909 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.
CVE-2026-93905 High 2026-10-13 Protected by Waratek No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances.
CVE-2026-93895 Critical 2026-10-13 No exploit published No public exploit IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
CVE-2026-88075 High 2026-10-13 Not applicable No public exploit Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
CVE-2026-87696 High 2026-10-13 Not applicable No public exploit Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-87695 High 2026-10-13 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-87692 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-85925 High 2026-10-13 Not applicable No public exploit Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
CVE-2026-85922 High 2026-10-13 Not applicable No public exploit Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-76001 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-75996 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-75995 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-75994 Critical 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-75748 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-71385 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-34634 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-34633 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106624 Critical 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106623 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction.
CVE-2026-106622 Critical 2026-10-13 Not applicable No public exploit ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106621 Critical 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
CVE-2026-106620 Critical 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106619 Critical 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106618 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106617 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106616 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106615 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106614 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106613 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.
CVE-2026-106612 Critical 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106090 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106089 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105994 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105903 Critical 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105901 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105900 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
CVE-2026-105899 Critical 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105898 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVE-2026-105897 High 2026-10-13 Not applicable No public exploit ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-103855 Medium 2026-10-13 Not applicable No public exploit Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103854 High 2026-10-13 Not applicable No public exploit Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103853 Medium 2026-10-13 Not applicable No public exploit Dimension is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-103847 High 2026-10-13 Not applicable No public exploit Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
CVE-2026-103846 High 2026-10-13 Not applicable No public exploit Dimension is affected by an Improper Neutralization of Input During Web Page Generation vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
CVE-2026-103845 High 2026-10-13 Not applicable No public exploit Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
CVE-2026-103844 High 2026-10-13 Not applicable No public exploit Dimension is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-87980 Medium 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs.
CVE-2026-84891 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials.
CVE-2026-84875 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-84290 Medium 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads.
CVE-2026-84278 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.
CVE-2026-84276 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.
CVE-2026-84275 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector.
CVE-2026-84274 Medium 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API_KEY rotation processing, sensitive credential material is logged at INFO level by the edge-controller/edge-manager components. An authenticated attacker with access to the relevant application or container logs could obtain these credentials and use them to impersonate services or gain unauthorized access to the Guardium control plane.
CVE-2026-84272 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.
CVE-2026-84271 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.
CVE-2026-84250 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges.
CVE-2026-84249 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
CVE-2026-84247 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
CVE-2026-84246 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-84245 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privileged local user could exploit this vulnerability to gain root privileges and access or modify sensitive system files.
CVE-2026-84244 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated Guardium user.
CVE-2026-84230 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.
CVE-2026-84209 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
CVE-2026-84198 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-84058 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.
CVE-2026-84057 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
CVE-2026-84035 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.
CVE-2026-84032 High 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper certificate validation.
CVE-2026-82900 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.
CVE-2026-82895 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.
CVE-2026-82344 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution on the affected system.
CVE-2026-82335 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution.
CVE-2026-82334 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service.
CVE-2026-81932 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2026-80381 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
CVE-2026-75875 Critical 2026-10-08 Not applicable No public exploit IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.
‹ prev page 3 of 238 next ›