WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product tics✕
Overview 1,790 matches · 191 in Waratek scope · 39 protected · 59 exploited · 35 CISA KEV · 104 public PoC · 57 EPSS ≥ 0.5
split by peak 213 / year
Not applicable: 1,526Outside Waratek scope: 73No exploit published: 147Mitigation candidate: 5Protected by Waratek: 39 Low: 25Medium: 727High: 852Critical: 186 not blocked: 1,751blocked by ARMR today: 39 No public exploit: 1,651Forecast only: 9Proof of concept only: 28Working exploit published: 43Exploited: 59
19981 Not applicable1 High1 not blocked1 No public exploit1 19992 Not applicable2 High1 Medium1 not blocked2 Working exploit published1 No public exploit1 20002 Not applicable2 High2 not blocked2 Working exploit published2 20010 20020 20031 Not applicable1 High1 not blocked1 No public exploit1 20040 20052 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20066 Protected by Waratek1 No exploit published1 Not applicable4 High5 Medium1 blocked by ARMR today1 not blocked5 Working exploit published1 No public exploit5 20071 Not applicable1 Medium1 not blocked1 Working exploit published1 20088 Not applicable8 High5 Medium3 not blocked8 Working exploit published3 No public exploit5 20097 Not applicable7 High2 Medium5 not blocked7 Working exploit published1 No public exploit6 20106 Not applicable6 Medium6 not blocked6 Working exploit published5 No public exploit1 20116 Not applicable6 High1 Medium5 not blocked6 No public exploit6 20124 Not applicable4 Critical1 High2 Medium1 not blocked4 Working exploit published1 No public exploit3 201317 Protected by Waratek1 No exploit published5 Not applicable11 Critical1 High12 Medium4 blocked by ARMR today1 not blocked16 Exploited2 Working exploit published2 No public exploit13 201429 Protected by Waratek1 No exploit published2 Not applicable26 Critical2 High8 Medium17 Low2 blocked by ARMR today1 not blocked28 Exploited5 Working exploit published2 No public exploit22 201528 Protected by Waratek4 Not applicable24 Critical2 High7 Medium19 blocked by ARMR today4 not blocked24 Exploited4 Working exploit published3 No public exploit21 201625 Protected by Waratek1 Not applicable24 Critical3 High13 Medium8 Low1 blocked by ARMR today1 not blocked24 Exploited2 No public exploit23 201779 Protected by Waratek1 No exploit published11 Outside Waratek scope2 Not applicable65 Critical10 High29 Medium40 blocked by ARMR today1 not blocked78 Exploited1 Working exploit published3 Proof of concept only1 No public exploit74 2018125 Protected by Waratek4 No exploit published11 Outside Waratek scope10 Not applicable100 Critical13 High52 Medium59 Low1 blocked by ARMR today4 not blocked121 Exploited4 Working exploit published4 Proof of concept only1 Forecast only1 No public exploit115 2019186 Protected by Waratek9 No exploit published16 Outside Waratek scope12 Not applicable149 Critical27 High65 Medium89 Low5 blocked by ARMR today9 not blocked177 Exploited5 Working exploit published2 Proof of concept only4 Forecast only2 No public exploit173 2020130 Protected by Waratek1 Mitigation candidate2 No exploit published17 Outside Waratek scope4 Not applicable106 Critical12 High63 Medium52 Low3 blocked by ARMR today1 not blocked129 Exploited3 Proof of concept only1 No public exploit126 2021137 Protected by Waratek3 Mitigation candidate1 No exploit published16 Outside Waratek scope21 Not applicable96 Critical13 High65 Medium57 Low2 blocked by ARMR today3 not blocked134 Exploited12 Working exploit published3 Proof of concept only1 Forecast only1 No public exploit120 2022165 Protected by Waratek5 No exploit published10 Outside Waratek scope17 Not applicable133 Critical27 High67 Medium68 Low3 blocked by ARMR today5 not blocked160 Exploited6 Working exploit published6 Proof of concept only4 Forecast only4 No public exploit145 2023206 Protected by Waratek6 Mitigation candidate2 No exploit published19 Outside Waratek scope1 Not applicable178 Critical29 High115 Medium62 blocked by ARMR today6 not blocked200 Exploited13 Working exploit published2 Proof of concept only6 Forecast only1 No public exploit184 2024199 Protected by Waratek1 No exploit published12 Outside Waratek scope6 Not applicable180 Critical19 High123 Medium57 blocked by ARMR today1 not blocked198 Exploited1 Proof of concept only5 No public exploit193 2025205 No exploit published12 Not applicable193 Critical14 High116 Medium71 Low4 not blocked205 Working exploit published1 Proof of concept only2 No public exploit202 2026213 Protected by Waratek1 No exploit published15 Not applicable197 Critical13 High96 Medium100 Low4 blocked by ARMR today1 not blocked212 Exploited1 Proof of concept only3 No public exploit209
1999200220052008201120142017202020232026
1,790 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 18 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2025-47397 High 2026-02-02 Not applicable No public exploit Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.
CVE-2025-47366 High 2026-02-02 Not applicable No public exploit Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
CVE-2026-22850 High 2026-01-19 Not applicable Proof of concept only Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL import. Unauthenticated visitors can submit arbitrary path (`pa`) and referrer (`r`) values to the public tracking endpoint in src/Resources/functions/collect.php, which stores those strings verbatim in the analytics tables. The admin export logic in src/Admin/Data_Export.php writes these stored values directly into SQL INSERT statements without escaping. A crafted path such as "),('999','x');DROP TABLE wp_users;-- breaks out of the value list. When an administrator later imports that export file, the import handler in src/Admin/Data_Import.php reads the uploaded SQL with file_get_contents, performs only a superficial header check, splits on semicolons, and executes each statement via $wpdb->query with no validation of table names or statement types. Additionally, any authenticated user with manage_koko_analytics can upload an arbitrary .sql file and have it executed in the same permissive way. Combined, attacker-controlled input flows from the tracking endpoint into exported SQL and through the import execution sink, or directly via malicious uploads, enabling arbitrary SQL execution. In a worst-case scenario, attackers can achieve arbitrary SQL execution on the WordPress database, allowing deletion of core tables (e.g., wp_users), insertion of backdoor administrator accounts, or other destructive/privilege-escalating actions. Version 2.1.3 patches the issue.
CVE-2026-1023 High 2026-01-16 Not applicable No public exploit Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly exploit a specific functionality to query database contents.
CVE-2026-1022 High 2026-01-16 Not applicable No public exploit Statistics Database System developed by Gotac has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
CVE-2025-59870 Critical 2026-01-16 Not applicable No public exploit HCL MyXalytics  is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
CVE-2025-47369 Medium 2026-01-07 Not applicable No public exploit Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
CVE-2025-47348 High 2026-01-07 Not applicable No public exploit Memory corruption while processing identity credential operations in the trusted application.
CVE-2025-47344 Medium 2026-01-07 Not applicable No public exploit Memory corruption while handling sensor utility operations.
CVE-2025-47334 Medium 2026-01-07 Not applicable No public exploit Memory corruption while processing shared command buffer packet between camera userspace and kernel.
CVE-2025-47333 Medium 2026-01-07 Not applicable No public exploit Memory corruption while handling buffer mapping operations in the cryptographic driver.
CVE-2025-47331 Medium 2026-01-07 Not applicable No public exploit Information disclosure while processing a firmware event.
CVE-2025-47330 Medium 2026-01-07 Not applicable No public exploit Transient DOS while parsing video packets received from the video firmware.
CVE-2025-68390 Medium 2025-12-18 No exploit published No public exploit Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.
CVE-2025-68384 Medium 2025-12-18 No exploit published No public exploit Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
CVE-2025-47323 High 2025-12-18 Not applicable No public exploit Memory corruption while routing GPR packets between user and root when handling large data packet.
CVE-2025-47322 High 2025-12-18 Not applicable No public exploit Memory corruption while handling IOCTL calls to set mode.
CVE-2025-47321 High 2025-12-18 Not applicable No public exploit Memory corruption while copying packets received from unix clients.
CVE-2025-47320 High 2025-12-18 Not applicable No public exploit Memory corruption while processing MFC channel configuration during music playback.
CVE-2025-27063 High 2025-12-18 Not applicable No public exploit Memory corruption during video playback when video session open fails with time out error.
CVE-2025-37731 High 2025-12-15 No exploit published No public exploit Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
CVE-2025-36437 Medium 2025-12-09 Not applicable No public exploit IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.
CVE-2025-36357 High 2025-11-17 Not applicable No public exploit IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system.
CVE-2025-36299 Medium 2025-11-17 Not applicable No public exploit IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system.
CVE-2025-33150 Medium 2025-11-10 Not applicable No public exploit IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages.
CVE-2025-10931 Low 2025-10-30 Not applicable No public exploit Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.
CVE-2025-9428 High 2025-10-21 Not applicable No public exploit Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api.
CVE-2025-9804 Critical 2025-10-16 No exploit published No public exploit An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
CVE-2025-61990 High 2025-10-15 Not applicable No public exploit When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-61958 High 2025-10-15 Not applicable No public exploit A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell.  For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-61951 High 2025-10-15 Not applicable No public exploit Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is enabled with a Server SSL profile that is configured with a certificate, key, and the SSL Sign Hash set to ANY, and the backend server is enabled with DTLS 1.2 and client authentication.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-59781 High 2025-10-15 Not applicable No public exploit When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-59483 High 2025-10-15 Not applicable No public exploit A validation vulnerability exists in an undisclosed URL in the Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-59481 High 2025-10-15 Not applicable No public exploit A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges.  A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-59269 High 2025-10-15 Not applicable No public exploit A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-59268 Medium 2025-10-15 Not applicable No public exploit On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attacker through the Configuration utility.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-58424 Medium 2025-10-15 Not applicable No public exploit On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity protection.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-58153 High 2025-10-15 Not applicable No public exploit Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge (HSB) may experience a lockup of the HSB.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-58096 High 2025-10-15 Not applicable No public exploit When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-58071 High 2025-10-15 Not applicable No public exploit When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-54755 Medium 2025-10-15 Not applicable No public exploit A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-53868 High 2025-10-15 Not applicable No public exploit When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-53856 High 2025-10-15 Not applicable No public exploit When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 .  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-53474 High 2025-10-15 Not applicable No public exploit When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-48008 High 2025-10-15 Not applicable No public exploit When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-46706 High 2025-10-15 Not applicable No public exploit When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-37727 Medium 2025-10-10 No exploit published No public exploit Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
CVE-2025-27054 High 2025-10-09 Not applicable No public exploit Memory corruption while processing a malformed license file during reboot.
CVE-2025-27053 High 2025-10-09 Not applicable No public exploit Memory corruption during PlayReady APP usecase while processing TA commands.
CVE-2025-9914 High 2025-10-06 Not applicable No public exploit The credentials of the users stored in the system's local database can be used for the log in, making it possible for an attacker to gain unauthorized access. This could potentially affect the confidentiality of the application.
CVE-2025-9913 Medium 2025-10-06 Not applicable No public exploit JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking.
CVE-2025-58591 High 2025-10-06 Not applicable No public exploit A remote, unauthorized attacker can brute force folders and files and read them like private keys or configurations, making the application vulnerable for gathering sensitive information.
CVE-2025-58590 High 2025-10-06 Not applicable No public exploit It's possible to brute force folders and files, what can be used by an attacker to steal sensitve information.
CVE-2025-58589 Medium 2025-10-06 Not applicable No public exploit When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker thus receives information about the technology used and the structure of the application.
CVE-2025-58587 Critical 2025-10-06 Not applicable No public exploit The application does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it possible for an attacker to guess user credentials.
CVE-2025-58586 Medium 2025-10-06 Not applicable No public exploit For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
CVE-2025-58585 High 2025-10-06 Not applicable No public exploit Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.
CVE-2025-58584 High 2025-10-06 Not applicable No public exploit In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally.
CVE-2025-58583 Medium 2025-10-06 Not applicable No public exploit The application provides access to a login protected H2 database for caching purposes. The username is prefilled.
CVE-2025-58582 High 2025-10-06 Not applicable No public exploit If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged.
CVE-2025-58581 Medium 2025-10-06 Not applicable No public exploit When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.
CVE-2025-58580 Medium 2025-10-06 Not applicable No public exploit An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.
CVE-2025-58579 Medium 2025-10-06 Not applicable No public exploit Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration.
CVE-2025-58578 Medium 2025-10-06 Not applicable No public exploit A user with the appropriate authorization can create any number of user accounts via an API endpoint using a POST request. There are no quotas, checking mechanisms or restrictions to limit the creation.
CVE-2025-52658 Medium 2025-10-03 Not applicable No public exploit HCL MyXalytics is affected by the use of vulnerable/outdated versions which can expose the application to known security risks that could be exploited.
CVE-2025-52656 High 2025-10-03 Not applicable No public exploit HCL MyXalytics: 6.6.  is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modification of sensitive fields.
CVE-2025-52654 Medium 2025-10-03 Not applicable No public exploit HCL MyXalytics v6.6 is affected by an HTML Injection. This issue occurs when untrusted input is included in the output without proper handling, potentially allowing unauthorized content injection and manipulation.
CVE-2025-52653 High 2025-10-03 Not applicable No public exploit HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentially resulting in unauthorized actions or access.
CVE-2025-36262 Medium 2025-09-30 Not applicable No public exploit IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input.
CVE-2025-36132 Medium 2025-09-30 Not applicable No public exploit IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-47318 High 2025-09-24 Not applicable No public exploit Transient DOS while parsing the EPTM test control message to get the test pattern.
CVE-2025-27032 High 2025-09-24 Not applicable No public exploit memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.
CVE-2025-21487 High 2025-09-24 Not applicable No public exploit Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
CVE-2025-21484 High 2025-09-24 Not applicable No public exploit Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
CVE-2025-21483 Critical 2025-09-24 Not applicable No public exploit Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.
CVE-2025-21482 High 2025-09-24 Not applicable No public exploit Cryptographic issue while performing RSA PKCS padding decoding.
CVE-2025-21481 High 2025-09-24 Not applicable No public exploit Memory corruption while performing private key encryption in trusted application.
CVE-2025-9364 High 2025-09-09 Not applicable No public exploit An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an attacker on the intranet accessing sensitive data and potential alteration of data.
CVE-2025-36174 High 2025-08-24 Not applicable No public exploit IBM Integrated Analytics System 1.0.0.0 through 1.0.30.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened.
CVE-2025-54500 Medium 2025-08-13 Not applicable No public exploit An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-52585 High 2025-08-13 Not applicable No public exploit When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-27066 High 2025-08-06 Not applicable No public exploit Transient DOS while processing an ANQP message.
CVE-2025-21465 Medium 2025-08-06 Not applicable No public exploit Information disclosure while processing the hash segment in an MBN file.
CVE-2025-21464 Medium 2025-08-06 Not applicable No public exploit Information disclosure while reading data from an image using specified offset and size parameters.
CVE-2024-41751 Medium 2025-07-23 Not applicable No public exploit IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data.
CVE-2024-41750 Medium 2025-07-23 Not applicable No public exploit IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data.
CVE-2024-40686 Medium 2025-07-23 Not applicable No public exploit IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
CVE-2024-40682 Medium 2025-07-23 Not applicable No public exploit IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local user to cause a denial of service due to improper validation of specified type of input.
CVE-2024-38335 Medium 2025-07-22 Not applicable No public exploit IBM Security QRadar Network Threat Analytics 1.0.0 through 1.3.1 could allow a privileged user to cause a denial of service due to improper allocation of resources.
CVE-2025-36107 High 2025-07-21 Not applicable No public exploit IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to obtain sensitive information due to the cleartext transmission of data.
CVE-2025-36106 High 2025-07-21 Not applicable No public exploit IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to view and modify information coming to and from the application which could then be used to access confidential information on the device or network by using a the deprecated or misconfigured AFNetworking library at runtime.
CVE-2025-36062 High 2025-07-21 Not applicable No public exploit IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could be vulnerable to information exposure due to the use of unencrypted network traffic.
CVE-2025-36057 Medium 2025-07-21 Not applicable No public exploit IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 is vulnerable to authentication bypass by using the Local Authentication Framework library which is not needed as biometric authentication is not used in the application.
CVE-2025-36090 Medium 2025-07-10 Not applicable No public exploit IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain information about the application framework which could be used in reconnaissance to gather information for future attacks from a detailed technical error message.
CVE-2024-39752 Critical 2025-07-10 Not applicable No public exploit IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could be vulnerable to malicious file upload by not validating the type of file uploaded to Explore Content. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.
CVE-2024-38327 Critical 2025-07-10 Not applicable No public exploit IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 is vulnerable to information exposure and further attacks due to an exposed JavaScript source map which could assist an attacker to read and debug JavaScript used in the application's API.
CVE-2024-37524 Medium 2025-07-10 Not applicable No public exploit IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.
CVE-2025-53655 Medium 2025-07-09 No exploit published No public exploit Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers to observe and capture it.
CVE-2025-53654 Medium 2025-07-09 No exploit published No public exploit Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
CVE-2025-27061 High 2025-07-08 Not applicable No public exploit Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
‹ prev page 3 of 18 next ›