WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor microsoft✕Product .net✕
Overview 376 matches · 1 in Waratek scope · 0 protected · 22 exploited · 8 CISA KEV · 36 public PoC · 24 EPSS ≥ 0.5
376matches 1in Waratek scope0.3% 0protected0.0% 22exploited5.9% 8CISA KEV2.1% 36public PoC9.6% 24EPSS ≥ 0.56.4%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 0.3% No exploit published 0 0.0% Outside Waratek scope 2 0.5% Not applicable 373 99.2% Withdrawn CVE 0 0.0%
Critical 15 4.0% High 273 72.6% Medium 86 22.9% Low 2 0.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 376 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 22 5.9% Working exploit published 23 6.1% Proof of concept only 7 1.9% Forecast only 3 0.8% No public exploit 321 85.4%
split by peak 71 / year
Not applicable: 373Outside Waratek scope: 2Mitigation candidate: 1 Low: 2Medium: 86High: 273Critical: 15 not blocked: 376 No public exploit: 321Forecast only: 3Proof of concept only: 7Working exploit published: 23Exploited: 22
20024 Not applicable4 High1 Medium3 not blocked4 No public exploit4 20031 Not applicable1 Medium1 not blocked1 No public exploit1 20043 Outside Waratek scope1 Not applicable2 Critical1 High2 not blocked3 Exploited1 Working exploit published2 20056 Not applicable6 High1 Medium5 not blocked6 Exploited1 Working exploit published1 No public exploit4 20068 Not applicable8 High2 Medium6 not blocked8 Exploited1 Working exploit published4 No public exploit3 20076 Not applicable6 High5 Medium1 not blocked6 Working exploit published1 No public exploit5 200810 Not applicable10 High8 Medium2 not blocked10 Exploited1 Working exploit published1 No public exploit8 200914 Not applicable14 High12 Medium1 Low1 not blocked14 Exploited3 No public exploit11 20107 Not applicable7 High3 Medium4 not blocked7 Exploited1 No public exploit6 20116 Not applicable6 High4 Medium2 not blocked6 Working exploit published1 No public exploit5 201213 Not applicable13 High11 Medium2 not blocked13 Working exploit published1 No public exploit12 201318 Not applicable18 High15 Medium3 not blocked18 Exploited1 Forecast only1 No public exploit16 201411 Not applicable11 High5 Medium6 not blocked11 Exploited2 Working exploit published2 No public exploit7 201521 Not applicable21 High14 Medium6 Low1 not blocked21 Exploited1 Working exploit published6 Forecast only1 No public exploit13 20169 Not applicable9 Critical1 High6 Medium2 not blocked9 Working exploit published2 No public exploit7 20179 Not applicable9 High8 Medium1 not blocked9 Exploited1 Working exploit published1 No public exploit7 201821 Not applicable21 Critical2 High16 Medium3 not blocked21 No public exploit21 201920 Not applicable20 High14 Medium6 not blocked20 No public exploit20 202015 Not applicable15 Critical1 High11 Medium3 not blocked15 Exploited3 No public exploit12 202113 Not applicable13 Critical2 High7 Medium4 not blocked13 No public exploit13 202217 Not applicable17 High11 Medium6 not blocked17 No public exploit17 202335 Mitigation candidate1 Not applicable34 Critical1 High30 Medium4 not blocked35 Exploited3 Proof of concept only5 Forecast only1 No public exploit26 202426 Not applicable26 Critical2 High19 Medium5 not blocked26 Exploited1 Proof of concept only2 No public exploit23 202512 Not applicable12 Critical1 High10 Medium1 not blocked12 Working exploit published1 No public exploit11 202671 Outside Waratek scope1 Not applicable70 Critical4 High58 Medium9 not blocked71 Exploited2 No public exploit69
2002200420062008201020122014201620182020202220242026
376 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 4 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-111497 Critical 2026-10-22 Outside Waratek scope Exploited A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVE-2026-97788 High 2026-10-13 Not applicable No public exploit Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
CVE-2026-96960 High 2026-10-13 Not applicable No public exploit Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96959 High 2026-10-13 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96958 High 2026-10-13 Not applicable No public exploit Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96957 High 2026-10-13 Not applicable No public exploit Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96222 High 2026-10-13 Not applicable No public exploit Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-88092 Critical 2026-10-13 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
CVE-2026-71328 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-69806 High 2026-09-08 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-69439 High 2026-09-08 Not applicable No public exploit Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-69304 Medium 2026-09-08 Not applicable No public exploit Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-58649 Medium 2026-09-08 Not applicable No public exploit Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-57099 High 2026-09-08 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-70354 High 2026-08-11 Not applicable No public exploit Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-65810 High 2026-08-11 Not applicable No public exploit Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
CVE-2026-62909 High 2026-08-11 Not applicable No public exploit Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-62902 Medium 2026-08-11 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62901 High 2026-08-11 Not applicable No public exploit Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-62900 Medium 2026-08-11 Not applicable No public exploit Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-62899 Medium 2026-08-11 Not applicable No public exploit Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-62898 High 2026-08-11 Not applicable No public exploit Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-62897 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-62886 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-62872 High 2026-08-11 Not applicable No public exploit Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.
CVE-2026-62871 High 2026-08-11 Not applicable No public exploit Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-58641 High 2026-08-11 Not applicable No public exploit Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-57108 High 2026-07-14 Not applicable No public exploit Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-56170 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-50659 Medium 2026-07-14 Not applicable No public exploit Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
CVE-2026-50653 High 2026-07-14 Not applicable No public exploit Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.
CVE-2026-50652 High 2026-07-14 Not applicable No public exploit Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.
CVE-2026-50651 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50650 High 2026-07-14 Not applicable No public exploit Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
CVE-2026-50649 High 2026-07-14 Not applicable No public exploit Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
CVE-2026-50648 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50647 High 2026-07-14 Not applicable No public exploit Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVE-2026-50646 High 2026-07-14 Not applicable No public exploit Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
CVE-2026-50528 High 2026-07-14 Not applicable No public exploit Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-50527 High 2026-07-14 Not applicable No public exploit Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50526 High 2026-07-14 Not applicable No public exploit Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
CVE-2026-50525 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-50524 High 2026-07-14 Not applicable No public exploit Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-50506 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-50411 High 2026-07-14 Not applicable No public exploit Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
CVE-2026-50368 High 2026-07-14 Not applicable No public exploit Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
CVE-2026-50355 High 2026-07-14 Not applicable No public exploit Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
CVE-2026-47304 Critical 2026-07-14 Not applicable No public exploit Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-47303 High 2026-07-14 Not applicable No public exploit Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-47302 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-47300 High 2026-07-14 Not applicable No public exploit Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
CVE-2026-45646 High 2026-07-14 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-45591 High 2026-06-09 Not applicable No public exploit Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-45491 Medium 2026-06-09 Not applicable No public exploit Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.
CVE-2026-45490 High 2026-06-09 Not applicable No public exploit Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-42899 High 2026-05-12 Not applicable No public exploit Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-35433 High 2026-05-12 Not applicable No public exploit Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-32177 High 2026-05-12 Not applicable No public exploit Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-32175 Medium 2026-05-12 Not applicable No public exploit A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker would have limited control over the destination of the files and directories. To exploit the vulnerability, an attacker must send a specially crafted file to a vulnerable system. The security update fixes the vulnerability by ensuring .NET Core properly handles files.
CVE-2026-40372 Critical 2026-04-21 Not applicable No public exploit Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-33116 High 2026-04-14 Not applicable No public exploit Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
CVE-2026-32226 Medium 2026-04-14 Not applicable No public exploit Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-32203 High 2026-04-14 Not applicable No public exploit Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
CVE-2026-32178 High 2026-04-14 Not applicable No public exploit Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-26171 High 2026-04-14 Not applicable No public exploit Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-23666 High 2026-04-14 Not applicable No public exploit Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.
CVE-2026-25667 High 2026-03-19 Not applicable No public exploit ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing.
CVE-2026-26131 High 2026-03-10 Not applicable No public exploit Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-26130 High 2026-03-10 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-26127 High 2026-03-10 Not applicable Exploited Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-21218 High 2026-02-10 Not applicable No public exploit Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-55315 Critical 2025-10-14 Not applicable Working exploit published Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
CVE-2025-55248 Medium 2025-10-14 Not applicable No public exploit Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.
CVE-2025-55247 High 2025-10-14 Not applicable No public exploit Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2025-30399 High 2025-06-13 Not applicable No public exploit Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2025-26646 High 2025-05-13 Not applicable No public exploit External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network.
CVE-2025-33072 High 2025-05-08 Not applicable No public exploit Improper access control in Azure allows an unauthorized attacker to disclose information over a network.
CVE-2025-26682 High 2025-04-08 Not applicable No public exploit Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2025-24070 High 2025-03-11 Not applicable No public exploit Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-21176 High 2025-01-14 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2025-21173 High 2025-01-14 Not applicable No public exploit .NET Elevation of Privilege Vulnerability
CVE-2025-21172 High 2025-01-14 Not applicable No public exploit .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2025-21171 High 2025-01-14 Not applicable No public exploit .NET Remote Code Execution Vulnerability
CVE-2024-43499 High 2024-11-12 Not applicable No public exploit .NET and Visual Studio Denial of Service Vulnerability
CVE-2024-43498 Critical 2024-11-12 Not applicable No public exploit .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2024-43485 High 2024-10-08 Not applicable No public exploit .NET and Visual Studio Denial of Service Vulnerability
CVE-2024-43484 High 2024-10-08 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVE-2024-43483 High 2024-10-08 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
CVE-2024-38229 High 2024-10-08 Not applicable No public exploit .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2024-38168 High 2024-08-13 Not applicable No public exploit .NET and Visual Studio Denial of Service Vulnerability
CVE-2024-38167 Medium 2024-08-13 Not applicable No public exploit .NET and Visual Studio Information Disclosure Vulnerability
CVE-2024-38095 High 2024-07-09 Not applicable No public exploit .NET and Visual Studio Denial of Service Vulnerability
CVE-2024-38081 High 2024-07-09 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2024-35264 High 2024-07-09 Not applicable No public exploit .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2024-30105 High 2024-07-09 Not applicable No public exploit .NET and Visual Studio Denial of Service Vulnerability
CVE-2024-30046 Medium 2024-05-14 Not applicable No public exploit Visual Studio Denial of Service Vulnerability
CVE-2024-30045 Medium 2024-05-14 Not applicable No public exploit .NET and Visual Studio Remote Code Execution Vulnerability
CVE-2024-28917 Medium 2024-04-09 Not applicable No public exploit Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability
CVE-2024-21409 High 2024-04-09 Not applicable No public exploit .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability
CVE-2024-29059 High 2024-03-23 Not applicable Exploited .NET Framework Information Disclosure Vulnerability
‹ prev page 1 of 4 next ›