WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product server✕Has a public PoC✕
Overview 2,585 matches · 138 in Waratek scope · 71 protected · 508 exploited · 299 CISA KEV · 632 EPSS ≥ 0.5
2,585matches 138in Waratek scope5.3% 71protected2.7% 508exploited19.7% 299CISA KEV11.6% 632EPSS ≥ 0.524.4%
Protected by Waratek 76 2.9% Rule in development 3 0.1% Mitigation candidate 59 2.3% No exploit published 0 0.0% Outside Waratek scope 94 3.6% Not applicable 2,353 91.0% Withdrawn CVE 0 0.0%
Critical 248 9.6% High 1,272 49.2% Medium 999 38.6% Low 66 2.6% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 71 2.7% partly blocked 5 0.2% not blocked 2,509 97.1% not established 0 0.0% unrecorded 0 0.0%
Exploited 508 19.7% Working exploit published 1,882 72.8% Proof of concept only 195 7.5% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 189 / year
Not applicable: 2,353Outside Waratek scope: 94Mitigation candidate: 59Rule in development: 3Protected by Waratek: 76 Low: 66Medium: 999High: 1,272Critical: 248 not blocked: 2,509partly blocked: 5blocked by ARMR today: 71 Proof of concept only: 195Working exploit published: 1,882Exploited: 508
19951 Not applicable1 High1 not blocked1 Working exploit published1 19965 Not applicable5 High2 Medium3 not blocked5 Working exploit published5 19976 Not applicable6 High2 Medium4 not blocked6 Working exploit published6 199811 Not applicable11 High6 Medium5 not blocked11 Working exploit published11 199950 Outside Waratek scope1 Not applicable49 High19 Medium27 Low4 not blocked50 Working exploit published50 200071 Mitigation candidate4 Outside Waratek scope1 Not applicable66 High26 Medium41 Low4 not blocked71 Exploited1 Working exploit published70 200180 Mitigation candidate1 Outside Waratek scope4 Not applicable75 Critical1 High30 Medium43 Low6 not blocked80 Exploited3 Working exploit published77 200299 Mitigation candidate2 Outside Waratek scope4 Not applicable93 Critical1 High51 Medium45 Low2 not blocked99 Exploited2 Working exploit published97 200366 Mitigation candidate1 Outside Waratek scope2 Not applicable63 Critical1 High34 Medium27 Low4 not blocked66 Exploited4 Working exploit published62 2004125 Mitigation candidate1 Outside Waratek scope1 Not applicable123 High46 Medium74 Low5 not blocked125 Exploited4 Working exploit published121 2005122 Mitigation candidate2 Outside Waratek scope3 Not applicable117 High57 Medium60 Low5 not blocked122 Exploited7 Working exploit published115 2006118 Mitigation candidate1 Outside Waratek scope6 Not applicable111 High55 Medium58 Low5 not blocked118 Exploited2 Working exploit published115 Proof of concept only1 2007117 Mitigation candidate1 Outside Waratek scope6 Not applicable110 Critical2 High60 Medium55 not blocked117 Exploited8 Working exploit published109 200891 Mitigation candidate2 Outside Waratek scope3 Not applicable86 Critical1 High47 Medium42 Low1 not blocked91 Exploited3 Working exploit published87 Proof of concept only1 200993 Protected by Waratek1 Mitigation candidate2 Outside Waratek scope7 Not applicable83 Critical1 High44 Medium46 Low2 blocked by ARMR today1 not blocked92 Exploited15 Working exploit published78 2010105 Protected by Waratek1 Mitigation candidate1 Outside Waratek scope2 Not applicable101 Critical2 High58 Medium42 Low3 blocked by ARMR today1 not blocked104 Exploited13 Working exploit published92 201156 Mitigation candidate2 Outside Waratek scope3 Not applicable51 Critical2 High27 Medium25 Low2 not blocked56 Exploited7 Working exploit published48 Proof of concept only1 201250 Mitigation candidate2 Outside Waratek scope7 Not applicable41 Critical5 High15 Medium29 Low1 not blocked50 Exploited8 Working exploit published39 Proof of concept only3 201347 Protected by Waratek1 Outside Waratek scope1 Not applicable45 Critical2 High25 Medium18 Low2 blocked by ARMR today1 not blocked46 Exploited11 Working exploit published35 Proof of concept only1 201453 Mitigation candidate4 Outside Waratek scope3 Not applicable46 Critical6 High28 Medium17 Low2 not blocked53 Exploited19 Working exploit published33 Proof of concept only1 201594 Protected by Waratek1 Outside Waratek scope1 Not applicable92 Critical7 High61 Medium14 Low12 blocked by ARMR today1 not blocked93 Exploited19 Working exploit published73 Proof of concept only2 2016110 Protected by Waratek4 Mitigation candidate2 Not applicable104 Critical10 High62 Medium36 Low2 blocked by ARMR today4 not blocked106 Exploited22 Working exploit published86 Proof of concept only2 2017189 Protected by Waratek11 Mitigation candidate2 Outside Waratek scope3 Not applicable173 Critical21 High69 Medium99 blocked by ARMR today9 partly blocked2 not blocked178 Exploited27 Working exploit published159 Proof of concept only3 2018140 Protected by Waratek9 Outside Waratek scope8 Not applicable123 Critical24 High71 Medium42 Low3 blocked by ARMR today8 partly blocked1 not blocked131 Exploited30 Working exploit published100 Proof of concept only10 2019143 Protected by Waratek11 Mitigation candidate1 Outside Waratek scope9 Not applicable122 Critical18 High90 Medium35 blocked by ARMR today10 partly blocked1 not blocked132 Exploited47 Working exploit published82 Proof of concept only14 202094 Protected by Waratek14 Mitigation candidate7 Outside Waratek scope6 Not applicable67 Critical30 High44 Medium20 blocked by ARMR today14 not blocked80 Exploited46 Working exploit published27 Proof of concept only21 202195 Protected by Waratek12 Mitigation candidate4 Outside Waratek scope5 Not applicable74 Critical26 High38 Medium31 blocked by ARMR today12 not blocked83 Exploited53 Working exploit published21 Proof of concept only21 202265 Protected by Waratek3 Rule in development1 Mitigation candidate1 Outside Waratek scope1 Not applicable59 Critical18 High37 Medium10 blocked by ARMR today3 not blocked62 Exploited30 Working exploit published15 Proof of concept only20 202375 Protected by Waratek3 Mitigation candidate3 Outside Waratek scope3 Not applicable66 Critical17 High48 Medium10 blocked by ARMR today3 not blocked72 Exploited43 Working exploit published13 Proof of concept only19 202464 Protected by Waratek2 Mitigation candidate4 Outside Waratek scope1 Not applicable57 Critical15 High40 Medium9 blocked by ARMR today1 partly blocked1 not blocked62 Exploited23 Working exploit published18 Proof of concept only23 202576 Protected by Waratek2 Rule in development2 Mitigation candidate7 Not applicable65 Critical19 High37 Medium20 blocked by ARMR today2 not blocked74 Exploited36 Working exploit published22 Proof of concept only18 202674 Protected by Waratek1 Mitigation candidate2 Outside Waratek scope3 Not applicable68 Critical19 High42 Medium12 Low1 blocked by ARMR today1 not blocked73 Exploited25 Working exploit published15 Proof of concept only34
19961999200220052008201120142017202020232026
2,585 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 26 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-119618 High 2026-11-11 Not applicable Proof of concept only Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
CVE-2026-111497 Critical 2026-10-22 Outside Waratek scope Exploited A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVE-2026-110447 Critical 2026-10-14 Not applicable Exploited Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.
CVE-2026-97798 High 2026-10-13 Not applicable Proof of concept only Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-97793 High 2026-10-13 Not applicable Proof of concept only Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
CVE-2026-83834 High 2026-10-13 Not applicable Proof of concept only Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVE-2026-21589 Critical 2026-10-05 Not applicable Exploited This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents. In some configurations, there may be some sensitive files that make this highly severe. This vulnerability allows an unauthenticated remote attacker to access specific files within the web application root directory in affected versions. The vulnerability must be addressed for affected versions of: -- Bitbucket Data Center, introduced in version >= 4.6.0, fix versions: 9.4.26, 10.2.8, 10.5.1 -- Confluence Data Center, introduced in version >= 5.10.0, fix versions 9.2.26, 10.2.19 -- Crowd Data Center, introduced in version >= 2.11.0, fix versions 6.3.7, 7.0.3, 7.1.7, 7.2.4 -- Jira Software Data Center, introduced in version >= 7.1.0, fix versions 9.12.40, 10.3.26, 11.3.12 -- Jira Service Management Data Center, introduced in version >= 3.1.0, fix versions 5.12.40, 10.3.26, 11.3.12 -- Bamboo Data Center >= 7.0.1, fix versions 10.2.24, 12.1.12 -- Crucible, fix versions 4.9.15 -- Fisheye, fix version 4.9.15 -- Exploitation requires prior knowledge of the target file's exact name and path. The vulnerability does not include the capability to enumerate or list directory contents.
CVE-2026-96656 High 2026-09-23 Not applicable Exploited Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
CVE-2026-96655 Medium 2026-09-23 Not applicable Exploited Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
CVE-2026-96654 Medium 2026-09-23 Not applicable Exploited Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
CVE-2026-96652 Medium 2026-09-23 Not applicable Exploited Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
CVE-2026-54617 Critical 2026-09-17 Outside Waratek scope Working exploit published GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without re-normalizing and verifying containment. This leaves parent-directory components in a no-leading-slash request and allows reading any file accessible to the LaunchServer process, including .keys/ecdsa_id, .keys/legacySalt, and LaunchServer.json. Disclosure of those files can expose signing keys, refresh-token material, and database credentials, enabling forged administrative access tokens and full authentication bypass. A normalizing L7 proxy may block the primary request form, but direct exposure and L4/TCP proxies remain affected, and netty.fileServerEnabled is enabled by default. This issue is fixed in 5.7.12.
CVE-2026-83991 Medium 2026-09-08 Not applicable Proof of concept only Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally.
CVE-2026-62911 High 2026-08-11 Not applicable Proof of concept only Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-62735 High 2026-08-11 Not applicable Proof of concept only Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
CVE-2026-49179 High 2026-08-11 Not applicable Proof of concept only Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.
CVE-2026-59310 Critical 2026-07-30 Not applicable Exploited VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
CVE-2026-60206 Critical 2026-07-21 Mitigation candidate Proof of concept only Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SAML to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-58644 Critical 2026-07-14 Not applicable Exploited Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-58635 High 2026-07-14 Not applicable Proof of concept only Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.
CVE-2026-55040 Critical 2026-07-14 Not applicable Exploited Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-54992 High 2026-07-14 Not applicable Proof of concept only Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.
CVE-2026-54121 High 2026-07-14 Not applicable Exploited Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
CVE-2026-50679 High 2026-07-14 Not applicable Proof of concept only Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-50522 Critical 2026-07-14 Not applicable Exploited Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-50416 Low 2026-07-14 Not applicable Proof of concept only Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally.
CVE-2026-50343 High 2026-07-14 Not applicable Proof of concept only Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
CVE-2026-49176 High 2026-07-14 Not applicable Proof of concept only Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.
CVE-2026-61459 Critical 2026-07-10 Not applicable Working exploit published MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causing the operator's bearer token to be transmitted externally and enabling full cluster compromise.
CVE-2026-57219 High 2026-07-10 Not applicable Working exploit published RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
CVE-2026-14620 Medium 2026-07-03 Not applicable Working exploit published webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
CVE-2026-49160 High 2026-06-09 Not applicable Proof of concept only Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network.
CVE-2026-45504 High 2026-06-09 Not applicable Proof of concept only Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-42980 High 2026-06-09 Not applicable Proof of concept only Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-42978 High 2026-06-09 Not applicable Proof of concept only Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
CVE-2026-49975 High 2026-06-08 Not applicable Proof of concept only Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
CVE-2026-42536 High 2026-06-08 Not applicable Proof of concept only Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2026-48710 Medium 2026-05-26 Outside Waratek scope Exploited Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
CVE-2026-34910 Critical 2026-05-22 Not applicable Exploited A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.
CVE-2026-34908 Critical 2026-05-22 Not applicable Exploited A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
CVE-2026-45585 Medium 2026-05-20 Not applicable Proof of concept only Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available. Mitigation FAQs Should I leverage the temporary mitigation? Microsoft recommends that you consider implementing these mitigations if you are concerned your devices and data are at risk of being compromised or stolen. For example, if your organization’s employees take their work devices home or on business travel. What impact to service availability/management could be caused by implementing the mitigations? Implementing these mitigations will not impact service availability or management operations. Do customers need to revert the changes made to mitigate the vulnerability once the security update to protect against this vulnerability is available? No. The security update will maintain the mitigation's behavior once the security update is installed. I am using TPM+PIN, am I at risk of this vulnerability being exploited No, if you are using TPM+PIN the vulnerability is not exploitable.
CVE-2026-24207 Critical 2026-05-20 Not applicable Working exploit published NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure.
CVE-2026-42897 High 2026-05-14 Not applicable Exploited Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-44403 High 2026-05-12 Not applicable Working exploit published Wing FTP Server before 8.1.3 contains an authenticated remote code execution vulnerability in the session serialization mechanism that allows authenticated administrators to inject arbitrary Lua code through the domain admin mydirectory field. Attackers can exploit unsafe serialization of session values into Lua source code without proper escaping of closing delimiters, causing the injected code to be executed when the poisoned session is loaded via loadfile().
CVE-2026-41096 Critical 2026-05-12 Not applicable Proof of concept only Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
CVE-2026-41089 Critical 2026-05-12 Not applicable Exploited Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
CVE-2026-40369 High 2026-05-12 Not applicable Proof of concept only Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-23870 High 2026-05-06 Not applicable Proof of concept only A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
CVE-2026-23918 High 2026-05-04 Not applicable Working exploit published Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue.
CVE-2026-41679 Critical 2026-04-23 Not applicable Exploited Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The chain consists of six API calls. The attack is fully automated, requires no user interaction, and works against the default deployment configuration. Version 2026.416.0 patches the issue.
CVE-2026-31431 High 2026-04-22 Not applicable Exploited In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
CVE-2026-33829 Medium 2026-04-14 Not applicable Working exploit published Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-33824 Critical 2026-04-14 Not applicable Exploited Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
CVE-2026-32223 Medium 2026-04-14 Not applicable Proof of concept only Heap-based buffer overflow in Windows USB Print Driver allows an unauthorized attacker to elevate privileges with a physical attack.
CVE-2026-32202 Medium 2026-04-14 Not applicable Exploited Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-27912 High 2026-04-14 Not applicable Proof of concept only Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network.
CVE-2026-34486 High 2026-04-09 Protected by Waratek Exploited Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
CVE-2026-5201 High 2026-03-31 Not applicable Proof of concept only A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.
CVE-2026-22739 High 2026-03-24 Mitigation candidate Working exploit published Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
CVE-2026-3854 High 2026-03-10 Not applicable Proof of concept only An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote code execution on the instance. During a git push operation, user-supplied push option values were not properly sanitized before being included in internal service headers. Because the internal header format used a delimiter character that could also appear in user input, an attacker could inject additional metadata fields through crafted push option values. This vulnerability was reported via the GitHub Bug Bounty program and has been fixed in GitHub Enterprise Server versions 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7 and 3.19.4.
CVE-2026-30965 Critical 2026-03-10 Not applicable Working exploit published Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other users by exploiting the redirectClassNameForKey query parameter. Exfiltrated session tokens can be used to take over user accounts. The vulnerability requires the attacker to be able to create or update an object with a new relation field, which depends on the Class-Level Permissions of at least one class. This vulnerability is fixed in 9.5.2-alpha.8 and 8.6.21.
CVE-2026-26128 High 2026-03-10 Not applicable Proof of concept only Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
CVE-2026-26114 High 2026-03-10 Not applicable Proof of concept only Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-24294 High 2026-03-10 Not applicable Proof of concept only Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
CVE-2026-26235 High 2026-02-12 Not applicable Working exploit published JUNG Smart Visu Server 1.1.1050 contains a denial of service vulnerability that allows unauthenticated attackers to remotely shutdown or reboot the server. Attackers can send a single POST request to trigger the server reboot without requiring any authentication.
CVE-2026-21510 High 2026-02-10 Not applicable Exploited Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-21508 High 2026-02-10 Not applicable Proof of concept only Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.
CVE-2026-21250 High 2026-02-10 Not applicable Working exploit published Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
CVE-2026-21248 High 2026-02-10 Not applicable Working exploit published Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
CVE-2026-21244 High 2026-02-10 Not applicable Working exploit published Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
CVE-2026-21962 Critical 2026-01-20 Not applicable Exploited Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in accessible data. Note: Affected version for Weblogic Server Proxy Plug-in for IIS is 12.2.1.4.0 only. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
CVE-2026-20817 High 2026-01-13 Not applicable Proof of concept only Improper handling of insufficient permissions or privileges in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-20805 Medium 2026-01-13 Not applicable Exploited Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
CVE-2025-68273 Medium 2026-01-01 Not applicable Working exploit published Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.
CVE-2025-54100 High 2025-12-09 Not applicable Proof of concept only Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.
CVE-2025-58044 Medium 2025-12-01 Not applicable Working exploit published JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.
CVE-2025-58360 Critical 2025-11-25 Protected by Waratek Exploited GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. This issue has been patched in GeoServer 2.25.6, GeoServer 2.26.3, and GeoServer 2.27.0.
CVE-2025-13315 Critical 2025-11-19 Not applicable Exploited Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password.
CVE-2025-62215 High 2025-11-11 Not applicable Exploited Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2025-60710 High 2025-11-11 Not applicable Exploited Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
CVE-2025-5605 Medium 2025-10-24 Mitigation candidate Exploited An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.
CVE-2025-5350 Medium 2025-10-24 Rule in development Working exploit published SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS) in the admin user's browser context. By tricking an administrator into accessing a crafted link, an attacker could force the server to fetch malicious content and reflect it into the admin’s browser, leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. While session cookies are protected with the HttpOnly flag, the XSS still poses a significant security risk. Furthermore, SSRF can be used by a privileged user to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable from the affected product.
CVE-2025-59287 Critical 2025-10-14 Not applicable Exploited Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
CVE-2025-59284 Medium 2025-10-14 Not applicable Proof of concept only Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally.
CVE-2025-59254 High 2025-10-14 Not applicable Working exploit published Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2025-58726 High 2025-10-14 Not applicable Proof of concept only Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-24990 High 2025-10-14 Not applicable Exploited Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.
CVE-2025-52472 Critical 2025-10-06 Mitigation candidate Exploited XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.
CVE-2025-41243 Critical 2025-09-16 Mitigation candidate Exploited Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.
CVE-2025-54918 High 2025-09-09 Not applicable Proof of concept only Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.
CVE-2025-54110 High 2025-09-09 Not applicable Proof of concept only Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2010-20121 Critical 2025-08-21 Not applicable Working exploit published EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD (Change Working Directory) command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack. This flaw enables remote code execution without authentication, as EasyFTP allows anonymous access by default. The vulnerability was resolved in version 1.7.0.12, after which the product was renamed “UplusFtp.”
CVE-2010-20113 Critical 2025-08-21 Not applicable Working exploit published EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface. When processing a GET request to list.html, the server fails to properly validate the length of the path parameter. Supplying an excessively long value causes a buffer overflow on the stack, potentially corrupting control flow structures. The vulnerability is exposed through the embedded web server and does not require authentication due to default anonymous access. The issue was resolved in version 1.7.0.12, after which the product was renamed to UplusFtp.
CVE-2012-10060 Critical 2025-08-13 Not applicable Working exploit published Sysax Multi Server versions prior to 5.55 contain a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service.
CVE-2025-53779 High 2025-08-12 Not applicable Proof of concept only Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
CVE-2025-53136 Medium 2025-08-12 Not applicable Proof of concept only Exposure of sensitive information to an unauthorized actor in Windows NT OS Kernel allows an authorized attacker to disclose information locally.
CVE-2025-50168 High 2025-08-12 Not applicable Proof of concept only Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
CVE-2025-50165 Critical 2025-08-12 Not applicable Proof of concept only Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
CVE-2025-50154 Medium 2025-08-12 Not applicable Working exploit published Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
CVE-2012-10030 Critical 2025-08-05 Not applicable Working exploit published FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or destination path. These conditions enable attackers to upload executable payloads and .mof files to locations such as system32 and wbem\mof, where Windows Management Instrumentation (WMI) automatically processes and executes them. This results in remote code execution with SYSTEM-level privileges, without requiring user interaction.
‹ prev page 1 of 26 next ›