Overview 23,389 matches · 52 in Waratek scope · 7 protected · 7 exploited · 0 CISA KEV · 134 public PoC · 0 EPSS ≥ 0.5
23,389matches
52in Waratek scope0.2%
7protected0.0%
7exploited0.0%
0CISA KEV0.0%
134public PoC0.6%
0EPSS ≥ 0.50.0%
Protected by Waratek
7
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
45
0.2%
Outside Waratek scope
0
0.0%
Not applicable
4,165
17.8%
Withdrawn CVE
19,172
82.0%
blocked by ARMR today
7
0.0%
partly blocked
0
0.0%
not blocked
23,382
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 6,081 / year
19921
Withdrawn CVE1
Unknown1
not blocked1
No public exploit1
19930
19941
Withdrawn CVE1
Unknown1
not blocked1
No public exploit1
19950
19961
Withdrawn CVE1
Unknown1
not blocked1
Working exploit published1
19971
Withdrawn CVE1
Unknown1
not blocked1
No public exploit1
19981
Withdrawn CVE1
Unknown1
not blocked1
No public exploit1
199929
Withdrawn CVE29
Unknown29
not blocked29
Working exploit published1
No public exploit28
20001
Withdrawn CVE1
Unknown1
not blocked1
No public exploit1
20013
Withdrawn CVE3
Unknown3
not blocked3
No public exploit3
200214
Withdrawn CVE14
Unknown14
not blocked14
Working exploit published2
No public exploit12
200321
Withdrawn CVE21
Unknown21
not blocked21
Working exploit published1
No public exploit20
200428
Withdrawn CVE28
Unknown28
not blocked28
No public exploit28
200578
Withdrawn CVE78
Unknown78
not blocked78
Working exploit published5
No public exploit73
200651
Withdrawn CVE51
Unknown51
not blocked51
Working exploit published3
No public exploit48
200780
Withdrawn CVE80
Unknown80
not blocked80
Working exploit published3
No public exploit77
200832
Withdrawn CVE32
Unknown32
not blocked32
Working exploit published5
No public exploit27
200946
Withdrawn CVE46
Unknown46
not blocked46
Working exploit published6
No public exploit40
201028
Withdrawn CVE28
Unknown28
not blocked28
Working exploit published2
No public exploit26
201122
Withdrawn CVE22
Unknown22
not blocked22
Working exploit published3
No public exploit19
201263
Withdrawn CVE63
Unknown63
not blocked63
Working exploit published5
No public exploit58
2013137
Withdrawn CVE137
Unknown137
not blocked137
Working exploit published20
No public exploit117
201480
Withdrawn CVE80
Unknown80
not blocked80
Working exploit published11
No public exploit69
2015101
Withdrawn CVE101
Unknown101
not blocked101
Working exploit published5
No public exploit96
201668
Withdrawn CVE68
Unknown68
not blocked68
Working exploit published4
No public exploit64
20173,471
Withdrawn CVE3,471
Unknown3,471
not blocked3,471
Exploited1
Working exploit published10
No public exploit3,460
20181,644
Withdrawn CVE1,644
Unknown1,644
not blocked1,644
Working exploit published5
Proof of concept only1
No public exploit1,638
20191,633
Withdrawn CVE1,633
Unknown1,633
not blocked1,633
Exploited1
Working exploit published3
No public exploit1,629
2020900
Withdrawn CVE900
Unknown900
not blocked900
Working exploit published5
No public exploit895
20211,801
Withdrawn CVE1,801
Unknown1,801
not blocked1,801
Working exploit published1
No public exploit1,800
20221,360
Not applicable2
Withdrawn CVE1,358
Unknown1,360
not blocked1,360
Working exploit published4
Proof of concept only6
No public exploit1,350
20232,134
Not applicable1
Withdrawn CVE2,133
Unknown2,134
not blocked2,134
Exploited1
Working exploit published6
Proof of concept only1
No public exploit2,126
2024759
Protected by Waratek1
Not applicable7
Withdrawn CVE751
Unknown759
blocked by ARMR today1
not blocked758
Exploited1
Working exploit published4
Proof of concept only1
No public exploit753
20252,719
Not applicable897
Withdrawn CVE1,822
Unknown2,719
not blocked2,719
Exploited2
Working exploit published3
Proof of concept only2
No public exploit2,712
20266,081
Protected by Waratek6
No exploit published45
Not applicable3,258
Withdrawn CVE2,772
Unknown6,081
blocked by ARMR today6
not blocked6,075
Exploited1
Proof of concept only3
No public exploit6,077
199319961999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-56909 | Unknown | 2026-11-10 | Not applicable | No public exploit | In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure software due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-56902 | Unknown | 2026-11-10 | Not applicable | No public exploit | In multiple locations, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-56898 | Unknown | 2026-11-10 | Not applicable | No public exploit | In aes256_cmac_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-56897 | Unknown | 2026-11-10 | Not applicable | No public exploit | In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestation certificates due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-55362 | Unknown | 2026-11-10 | Not applicable | No public exploit | In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-55360 | Unknown | 2026-11-10 | Not applicable | No public exploit | In secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass secure transport channel encryption due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-55348 | Unknown | 2026-11-10 | Not applicable | No public exploit | In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sign extension of a negative buffer size due to an improper or implicit cast. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-55335 | Unknown | 2026-11-10 | Not applicable | No public exploit | In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-55319 | Unknown | 2026-11-10 | Not applicable | No public exploit | In thread_free of thread.c, there is a possible way to corrupt kernel heap metadata on thread creation failure due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-55316 | Unknown | 2026-11-10 | Not applicable | No public exploit | In handle_dpm_image of seclib.rs, there is a possible Logic error due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-55311 | Unknown | 2026-11-10 | Not applicable | No public exploit | In N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-55309 | Unknown | 2026-11-10 | Not applicable | No public exploit | In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault injection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-14447 | Unknown | 2026-11-10 | Not applicable | No public exploit | In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-by-one check due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-126136 | Unknown | 2026-11-10 | Not applicable | No public exploit | For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured server URL used unencrypted HTTP. An attacker able to observe network traffic could obtain the token and use it to access the user's mailbox until the token expired. An attacker positioned on the network during account setup could cause such a URL to be configured. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. |
| CVE-2026-126135 | Unknown | 2026-11-10 | Not applicable | No public exploit | If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would process these responses after the handshake, as if they had been received from the server over the encrypted connection. This could be used to make Thunderbird report a different outcome for sending or fetching mail, and to show attacker-controlled text in error messages. The encrypted connection itself was not compromised, and credentials were not exposed. Connections using SSL/TLS instead of STARTTLS were not affected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. |
| CVE-2026-126134 | Unknown | 2026-11-10 | Not applicable | No public exploit | Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. |
| CVE-2026-126133 | Unknown | 2026-11-10 | Not applicable | No public exploit | When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent without any user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even for calendars served over HTTPS. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. |
| CVE-2026-126132 | Unknown | 2026-11-10 | Not applicable | No public exploit | When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was replaced with the content of the file or URL it pointed to when the message was saved or sent. This could disclose local files, or content from the user's network, to the message recipients or to the mail provider. This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7. |
| CVE-2026-126129 | Unknown | 2026-11-10 | Not applicable | No public exploit | The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints. |
| CVE-2026-126128 | Unknown | 2026-11-10 | Not applicable | No public exploit | The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit. |
| CVE-2026-126082 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE is a duplicate of another CVE. |
| CVE-2026-125729 | Unknown | 2026-11-10 | Not applicable | No public exploit | Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce it. The call method sets the policy in a response header named "content-security-protocol" instead of "Content-Security-Policy". Browsers ignore that header. Any cross-site scripting flaw in the wrapped application can run scripts the policy was meant to block. |
| CVE-2026-125346 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: Duplicate CVE. Replaced by CVE-2026-125350 |
| CVE-2026-124951 | Unknown | 2026-11-10 | Not applicable | No public exploit | Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124950 | Unknown | 2026-11-10 | Not applicable | No public exploit | Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-124949 | Unknown | 2026-11-10 | Not applicable | No public exploit | Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-124946 | Unknown | 2026-11-10 | Not applicable | No public exploit | Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-124945 | Unknown | 2026-11-10 | Not applicable | No public exploit | Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-124942 | Unknown | 2026-11-10 | Not applicable | No public exploit | Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124940 | Unknown | 2026-11-10 | Not applicable | No public exploit | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124939 | Unknown | 2026-11-10 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124938 | Unknown | 2026-11-10 | Not applicable | No public exploit | Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124937 | Unknown | 2026-11-10 | Not applicable | No public exploit | Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160. |
| CVE-2026-124936 | Unknown | 2026-11-10 | Not applicable | No public exploit | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-124935 | Unknown | 2026-11-10 | Not applicable | No public exploit | Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124934 | Unknown | 2026-11-10 | Not applicable | No public exploit | Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124933 | Unknown | 2026-11-10 | Not applicable | No public exploit | Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124931 | Unknown | 2026-11-10 | Not applicable | No public exploit | Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124928 | Unknown | 2026-11-10 | Not applicable | No public exploit | Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-124927 | Unknown | 2026-11-10 | Not applicable | No public exploit | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124923 | Unknown | 2026-11-10 | Not applicable | No public exploit | Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-124921 | Unknown | 2026-11-10 | Not applicable | No public exploit | Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-124920 | Unknown | 2026-11-10 | Not applicable | No public exploit | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. |
| CVE-2026-124914 | Unknown | 2026-11-10 | Not applicable | No public exploit | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124913 | Unknown | 2026-11-10 | Not applicable | No public exploit | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124912 | Unknown | 2026-11-10 | Not applicable | No public exploit | Spoofing issue in the DOM: Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124911 | Unknown | 2026-11-10 | Not applicable | No public exploit | Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160. |
| CVE-2026-124910 | Unknown | 2026-11-10 | Not applicable | No public exploit | Mitigation bypass in the WebExtensions component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124905 | Unknown | 2026-11-10 | Not applicable | No public exploit | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124902 | Unknown | 2026-11-10 | Not applicable | No public exploit | Same-origin policy bypass due to race condition in the Audio/Video component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124901 | Unknown | 2026-11-10 | Not applicable | No public exploit | Other issue in the Networking: JAR component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124896 | Unknown | 2026-11-10 | Not applicable | No public exploit | Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124886 | Unknown | 2026-11-10 | Not applicable | No public exploit | Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124879 | Unknown | 2026-11-10 | Not applicable | No public exploit | Invalid pointer in the Networking: Cache component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124874 | Unknown | 2026-11-10 | Not applicable | No public exploit | Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124873 | Unknown | 2026-11-10 | Not applicable | No public exploit | Invalid pointer in the DOM: Editor component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124855 | Unknown | 2026-11-10 | Not applicable | No public exploit | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-124854 | Unknown | 2026-11-10 | Not applicable | No public exploit | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7. |
| CVE-2026-123439 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123438 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123437 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123435 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123432 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123431 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123430 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123429 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123427 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123426 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123425 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-123424 | Unknown | 2026-11-10 | Withdrawn CVE | No public exploit | Rejected reason: This CVE ID has been rejected as a duplicate. |
| CVE-2026-120212 | Unknown | 2026-11-10 | Not applicable | No public exploit | Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output. HTML::Tags and XML::Tags escape a plain string value by replacing only &, ", < and > with entities. A value interpolated into a single-quoted attribute, as in <a href='$value'>, can therefore close the attribute and add new ones, such as an event handler. Double-quoted attributes are not affected. An attacker who controls a value that an application interpolates into a single-quoted attribute can inject script into the generated page. |
| CVE-2026-111264 | Unknown | 2026-11-10 | No exploit published | No public exploit | The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111263 | Unknown | 2026-11-10 | No exploit published | No public exploit | Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its own web.xml security constraints or EJB method permissions. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111262 | Unknown | 2026-11-10 | No exploit published | No public exploit | The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111261 | Unknown | 2026-11-10 | No exploit published | No public exploit | The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111260 | Unknown | 2026-11-10 | No exploit published | No public exploit | The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111259 | Unknown | 2026-11-10 | No exploit published | No public exploit | The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111258 | Unknown | 2026-11-10 | No exploit published | No public exploit | The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111257 | Unknown | 2026-11-10 | No exploit published | No public exploit | With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111256 | Unknown | 2026-11-10 | No exploit published | No public exploit | When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silently ignored and the endpoint is published without authentication. A remote unauthenticated attacker can invoke the exposed operations without credentials. Only deployments that use the embedded HTTP server and rely on such an authentication method are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions. |
| CVE-2026-111251 | Unknown | 2026-11-10 | No exploit published | No public exploit | The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111250 | Unknown | 2026-11-10 | No exploit published | No public exploit | The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthenticated attacker can access functionality protected this way. Only applications served by the embedded HTTP server that rely on programmatic authentication are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions. |
| CVE-2026-111249 | Unknown | 2026-11-10 | No exploit published | No public exploit | The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111248 | Unknown | 2026-11-10 | No exploit published | No public exploit | The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111247 | Unknown | 2026-11-10 | No exploit published | No public exploit | When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the roles assigned by the realm. An authenticated attacker who can obtain an account whose user name equals a role name, for example through self-registration, is granted that role wherever authorization is evaluated through the Jakarta Authorization policy. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111246 | Unknown | 2026-11-10 | No exploit published | No public exploit | The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions. |
| CVE-2026-111245 | Unknown | 2026-11-10 | No exploit published | No public exploit | After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request completes when web services are served by the standalone OpenEJB HTTP server. A remote unauthenticated attacker whose request is later processed on the same thread can invoke protected EJB methods with the identity of a previously authenticated user. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111244 | Unknown | 2026-11-10 | No exploit published | No public exploit | When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources that declare an empty set of allowed roles are accessible to every caller, resource classes that inherit the same method from a common superclass share their constraints, and class-level constraints declared on a superclass are ignored. A remote attacker can invoke resources that should be denied to them, in some configurations without authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111243 | Unknown | 2026-11-10 | No exploit published | No public exploit | A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such configurations, an attacker in possession of an expired token can still authenticate with it. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111242 | Unknown | 2026-11-10 | No exploit published | No public exploit | When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is not always cleared from the processing thread when the request does not complete normally. A remote attacker holding a valid token can cause later, unrelated requests served by the same thread to invoke enterprise beans with the elevated run-as identity. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111241 | Unknown | 2026-11-10 | Protected by Waratek | No public exploit | When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that directory can read passivated session state or supply data that the server deserializes, potentially leading to code execution as the server process. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111240 | Unknown | 2026-11-10 | No exploit published | No public exploit | The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remote attacker who knows the user name of such an account can authenticate as that user and obtain its roles. Only deployments using this login module with NULL passwords in the user table are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. |
| CVE-2026-111239 | Unknown | 2026-11-10 | No exploit published | No public exploit | The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that domain, including a low-privileged application user, can execute arbitrary code as the server process. Users are recommended to disable the SSH administration service, or to block network access to it from untrusted clients and restrict its login domain to administrative users. |
| CVE-2026-108167 | Unknown | 2026-11-10 | Not applicable | No public exploit | The auth0-ai-python FGA retriever does not distinguish between authorization checks under different users, relations, or conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response. |
| CVE-2026-107496 | Unknown | 2026-11-10 | Not applicable | No public exploit | Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely. Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service. CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns. The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop. OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option. The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected. The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely. FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached. |
| CVE-2026-107372 | Unknown | 2026-11-10 | Not applicable | No public exploit | The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response. |
| CVE-2026-0195 | Unknown | 2026-11-10 | Not applicable | No public exploit | In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0193 | Unknown | 2026-11-10 | Not applicable | No public exploit | In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation. |
| CVE-2026-0191 | Unknown | 2026-11-10 | Not applicable | No public exploit | In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. |
| CVE-2026-0178 | Unknown | 2026-11-10 | Not applicable | No public exploit | In multiple functions of arm-smmu-v3.c, there is a possible way to bypass direct memory access isolation via stale stream table entries due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |