Overview 370 matches · 14 in Waratek scope · 6 protected · 26 exploited · 21 CISA KEV · 45 public PoC · 32 EPSS ≥ 0.5
370matches
14in Waratek scope3.8%
6protected1.6%
26exploited7.0%
21CISA KEV5.7%
45public PoC12.2%
32EPSS ≥ 0.58.6%
Protected by Waratek
6
1.6%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
8
2.2%
Outside Waratek scope
40
10.8%
Not applicable
316
85.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
6
1.6%
partly blocked
0
0.0%
not blocked
364
98.4%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 142 / year
20091
Not applicable1
Critical1
not blocked1
No public exploit1
20102
Not applicable2
Critical2
not blocked2
No public exploit2
20110
20126
Outside Waratek scope2
Not applicable4
Critical6
not blocked6
Exploited3
No public exploit3
20137
Not applicable7
Critical7
not blocked7
Exploited1
No public exploit6
201412
Not applicable12
Critical12
not blocked12
Exploited5
No public exploit7
20159
No exploit published1
Outside Waratek scope1
Not applicable7
Critical9
not blocked9
Exploited6
No public exploit3
201623
Protected by Waratek1
Not applicable22
Critical23
blocked by ARMR today1
not blocked22
Exploited4
Working exploit published1
Forecast only1
No public exploit17
201752
Protected by Waratek2
No exploit published2
Outside Waratek scope12
Not applicable36
Critical52
blocked by ARMR today2
not blocked50
Exploited1
Working exploit published6
No public exploit45
2018142
Protected by Waratek3
Outside Waratek scope11
Not applicable128
Critical142
blocked by ARMR today3
not blocked139
Exploited1
Working exploit published11
Forecast only1
No public exploit129
201949
No exploit published3
Outside Waratek scope7
Not applicable39
Critical49
not blocked49
Exploited2
Working exploit published2
Proof of concept only1
No public exploit44
20207
Outside Waratek scope3
Not applicable4
Critical7
not blocked7
Working exploit published1
Forecast only1
No public exploit5
202118
Outside Waratek scope2
Not applicable16
Critical18
not blocked18
Exploited1
No public exploit17
202213
Outside Waratek scope2
Not applicable11
Critical13
not blocked13
Proof of concept only1
No public exploit12
20235
Not applicable5
Critical5
not blocked5
Proof of concept only1
No public exploit4
20243
Not applicable3
Critical3
not blocked3
No public exploit3
20253
Not applicable3
Critical3
not blocked3
Exploited1
Proof of concept only1
No public exploit1
202618
No exploit published2
Not applicable16
Critical18
not blocked18
Exploited1
Proof of concept only2
No public exploit15
201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-102560 | Critical | 2026-09-29 | Not applicable | No public exploit | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow. |
| CVE-2026-11861 | Critical | 2026-08-20 | Not applicable | No public exploit | A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain. |
| CVE-2026-59090 | Critical | 2026-08-10 | Not applicable | Proof of concept only | A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system. |
| CVE-2026-58016 | Critical | 2026-06-30 | Not applicable | No public exploit | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service. |
| CVE-2026-53006 | Critical | 2026-06-24 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr when net_dbg_ratelimited() is called in the slow path. - Avoid potential future misuse after pskb_pull() call. |
| CVE-2026-53002 | Critical | 2026-06-24 | Not applicable | No public exploit | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer size in mangle_content_len() while at it. BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 mangle_content_len+0x1ac/0x280 nf_nat_sdp_session+0x1cc/0x240 process_sdp+0x8f8/0xb80 process_invite_request+0x108/0x2b0 process_sip_msg+0x5da/0xf50 sip_help_tcp+0x45e/0x780 nf_confirm+0x34d/0x990 [..] |
| CVE-2026-42055 | Critical | 2026-06-17 | Not applicable | No public exploit | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-4408 | Critical | 2026-05-28 | Not applicable | Proof of concept only | A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-characters. This vulnerability allows an attacker to achieve remote command execution on the affected system. This issue primarily affects non-standard configurations where the "check password script" is used with %u and the samba-dcerpcd service is started as a system service. |
| CVE-2026-4480 | Critical | 2026-05-26 | Not applicable | Exploited | A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially crafted print job description that contains unescaped shell characters. This could lead to remote code execution on the affected system. |
| CVE-2026-9256 | Critical | 2026-05-22 | Not applicable | No public exploit | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-42010 | Critical | 2026-05-07 | Not applicable | No public exploit | A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process. |
| CVE-2026-34002 | Critical | 2026-05-05 | Not applicable | No public exploit | A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service. |
| CVE-2026-34000 | Critical | 2026-05-05 | Not applicable | No public exploit | A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server. |
| CVE-2026-33845 | Critical | 2026-04-30 | Not applicable | No public exploit | A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service. |
| CVE-2026-5121 | Critical | 2026-03-30 | Not applicable | No public exploit | A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system. |
| CVE-2026-28369 | Critical | 2026-03-27 | No exploit published | No public exploit | A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure. |
| CVE-2026-28368 | Critical | 2026-03-27 | No exploit published | No public exploit | A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources. |
| CVE-2026-1709 | Critical | 2026-02-06 | Not applicable | No public exploit | A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate. |
| CVE-2025-14087 | Critical | 2025-12-10 | Not applicable | No public exploit | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings. |
| CVE-2025-32463 | Critical | 2025-06-30 | Not applicable | Exploited | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. |
| CVE-2024-12084 | Critical | 2025-01-15 | Not applicable | Proof of concept only | A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. |
| CVE-2024-44070 | Critical | 2024-08-19 | Not applicable | No public exploit | An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the TLV value. |
| CVE-2023-6816 | Critical | 2024-01-18 | Not applicable | No public exploit | A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used. |
| CVE-2023-6395 | Critical | 2024-01-16 | Not applicable | No public exploit | The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja2 templates, which may be included in certain configuration parameters. While the Mock documentation advises treating users added to the mock group as privileged, certain build systems invoking mock on behalf of users might inadvertently permit less privileged users to define configuration tags. These tags could then be passed as parameters to mock during execution, potentially leading to the utilization of Jinja2 templates for remote privilege escalation and the execution of arbitrary code as the root user on the build server. |
| CVE-2023-5550 | Critical | 2023-11-09 | Not applicable | No public exploit | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution. |
| CVE-2023-46846 | Critical | 2023-11-03 | Not applicable | No public exploit | SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems. |
| CVE-2023-3961 | Critical | 2023-11-03 | Not applicable | No public exploit | A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes. |
| CVE-2023-34152 | Critical | 2023-05-30 | Not applicable | Proof of concept only | A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured. |
| CVE-2023-2319 | Critical | 2023-05-17 | Not applicable | No public exploit | It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was previously addressed in Red Hat Enterprise Linux 9.1 via erratum RHSA-2023:1591. The CVE-2023-2319 was assigned to that Red Hat specific security regression in Red Hat Enterprise Linux 9.2. |
| CVE-2022-4170 | Critical | 2022-12-09 | Not applicable | No public exploit | The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set. |
| CVE-2022-45152 | Critical | 2022-11-25 | Not applicable | No public exploit | A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks. |
| CVE-2022-40315 | Critical | 2022-09-30 | Not applicable | No public exploit | A limited SQL injection risk was identified in the "browse list of users" site administration page. |
| CVE-2022-30600 | Critical | 2022-05-18 | Not applicable | No public exploit | A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed. |
| CVE-2022-30599 | Critical | 2022-05-18 | Not applicable | No public exploit | A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria. |
| CVE-2022-1587 | Critical | 2022-05-16 | Outside Waratek scope | No public exploit | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers. |
| CVE-2022-1586 | Critical | 2022-05-16 | Outside Waratek scope | No public exploit | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT. |
| CVE-2022-24882 | Critical | 2022-04-26 | Not applicable | Proof of concept only | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds. |
| CVE-2022-25648 | Critical | 2022-04-19 | Not applicable | No public exploit | The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. |
| CVE-2021-3657 | Critical | 2022-02-18 | Not applicable | No public exploit | A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution. |
| CVE-2021-20325 | Critical | 2022-02-18 | Not applicable | No public exploit | Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be vulnerable to the mentioned CVEs, even if they were properly fixed in Red Hat Enterprise Linux 8.4. CVE-2021-20325 was assigned to that Red Hat specific security regression and it does not affect the upstream versions of httpd. |
| CVE-2021-3773 | Critical | 2022-02-16 | Not applicable | No public exploit | A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks. |
| CVE-2021-45079 | Critical | 2022-01-31 | Not applicable | No public exploit | In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication. |
| CVE-2021-4048 | Critical | 2021-12-08 | Not applicable | No public exploit | An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these functions could cause an application using lapack to crash or possibly disclose portions of its memory. |
| CVE-2021-40438 | Critical | 2021-09-16 | Outside Waratek scope | Exploited | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. |
| CVE-2021-20314 | Critical | 2021-08-12 | Not applicable | No public exploit | Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages. |
| CVE-2021-20236 | Critical | 2021-05-28 | Not applicable | No public exploit | A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. |
| CVE-2020-36331 | Critical | 2021-05-21 | Not applicable | No public exploit | A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service availability. |
| CVE-2020-36330 | Critical | 2021-05-21 | Not applicable | No public exploit | A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the service availability. |
| CVE-2020-36329 | Critical | 2021-05-21 | Not applicable | No public exploit | A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
| CVE-2020-36328 | Critical | 2021-05-21 | Not applicable | No public exploit | A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
| CVE-2018-25014 | Critical | 2021-05-21 | Not applicable | No public exploit | A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol(). |
| CVE-2018-25013 | Critical | 2021-05-21 | Not applicable | No public exploit | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes(). |
| CVE-2018-25012 | Critical | 2021-05-21 | Not applicable | No public exploit | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24(). |
| CVE-2018-25011 | Critical | 2021-05-21 | Not applicable | No public exploit | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16(). |
| CVE-2018-25010 | Critical | 2021-05-21 | Not applicable | No public exploit | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter(). |
| CVE-2018-25009 | Critical | 2021-05-21 | Not applicable | No public exploit | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16(). |
| CVE-2021-3466 | Critical | 2021-03-25 | Not applicable | No public exploit | A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in an application that uses libmicrohttpd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Only version 0.9.70 is vulnerable. |
| CVE-2019-10196 | Critical | 2021-03-19 | Not applicable | No public exploit | A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter. |
| CVE-2021-20232 | Critical | 2021-03-12 | Not applicable | No public exploit | A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences. |
| CVE-2021-20231 | Critical | 2021-03-12 | Outside Waratek scope | No public exploit | A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences. |
| CVE-2020-27846 | Critical | 2020-12-21 | Not applicable | No public exploit | A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. |
| CVE-2014-4650 | Critical | 2020-02-20 | Outside Waratek scope | Working exploit published | The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator. |
| CVE-2014-8089 | Critical | 2020-02-17 | Not applicable | No public exploit | SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte. |
| CVE-2015-5741 | Critical | 2020-02-08 | Not applicable | No public exploit | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields. |
| CVE-2019-15606 | Critical | 2020-02-07 | Outside Waratek scope | No public exploit | Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons |
| CVE-2019-15605 | Critical | 2020-02-07 | Outside Waratek scope | Forecast only | HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed |
| CVE-2019-14906 | Critical | 2020-01-07 | Not applicable | No public exploit | A flaw was found with the RHSA-2019:3950 erratum, where it did not fix the CVE-2019-13616 SDL vulnerability. This issue only affects Red Hat SDL packages, SDL versions through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow flaw while copying an existing surface into a new optimized one, due to a lack of validation while loading a BMP image, is possible. An application that uses SDL to parse untrusted input files may be vulnerable to this flaw, which could allow an attacker to make the application crash or execute code. |
| CVE-2019-5544 | Critical | 2019-12-06 | Not applicable | Exploited | OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. |
| CVE-2019-19334 | Critical | 2019-12-06 | Not applicable | No public exploit | In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution. |
| CVE-2019-19333 | Critical | 2019-12-06 | Not applicable | No public exploit | In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "bits". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution. |
| CVE-2019-14896 | Critical | 2019-11-27 | Not applicable | No public exploit | A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP. |
| CVE-2011-2717 | Critical | 2019-11-27 | Not applicable | No public exploit | The DHCPv6 client (dhcp6c) as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message. |
| CVE-2014-3585 | Critical | 2019-11-22 | Not applicable | No public exploit | redhat-upgrade-tool: Does not check GPG signatures when upgrading versions |
| CVE-2019-19012 | Critical | 2019-11-17 | Not applicable | No public exploit | An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information disclosure, or possibly have unspecified other impact, via a crafted regular expression. |
| CVE-2011-2897 | Critical | 2019-11-12 | Not applicable | No public exploit | gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw |
| CVE-2019-18805 | Critical | 2019-11-07 | Outside Waratek scope | No public exploit | An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6. |
| CVE-2015-8980 | Critical | 2019-11-04 | Not applicable | No public exploit | The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. |
| CVE-2013-4409 | Critical | 2019-11-04 | Not applicable | No public exploit | An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. |
| CVE-2019-11043 | Critical | 2019-10-28 | Outside Waratek scope | Exploited | In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. |
| CVE-2019-17631 | Critical | 2019-10-17 | No exploit published | No public exploit | From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks. |
| CVE-2018-16451 | Critical | 2019-10-03 | Not applicable | No public exploit | The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN. |
| CVE-2018-16230 | Critical | 2019-10-03 | Not applicable | No public exploit | The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI). |
| CVE-2018-16228 | Critical | 2019-10-03 | Not applicable | No public exploit | The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix(). |
| CVE-2018-14882 | Critical | 2019-10-03 | Not applicable | No public exploit | The ICMPv6 parser in tcpdump before 4.9.3 has a buffer over-read in print-icmp6.c. |
| CVE-2018-14881 | Critical | 2019-10-03 | Not applicable | No public exploit | The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_capabilities_print() (BGP_CAPCODE_RESTART). |
| CVE-2019-14813 | Critical | 2019-09-06 | Not applicable | No public exploit | A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands. |
| CVE-2019-1010238 | Critical | 2019-07-19 | Outside Waratek scope | No public exploit | Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize. |
| CVE-2019-10126 | Critical | 2019-06-14 | Outside Waratek scope | No public exploit | A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other consequences. |
| CVE-2019-10160 | Critical | 2019-06-07 | Outside Waratek scope | No public exploit | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application. |
| CVE-2019-11356 | Critical | 2019-06-03 | Not applicable | No public exploit | The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name. |
| CVE-2019-12450 | Critical | 2019-05-29 | Not applicable | No public exploit | file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used. |
| CVE-2019-9792 | Critical | 2019-04-26 | Not applicable | Working exploit published | The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then be used by JavaScript to achieve memory corruption, which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. |
| CVE-2019-9791 | Critical | 2019-04-26 | Not applicable | Working exploit published | The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. |
| CVE-2019-9788 | Critical | 2019-04-26 | Not applicable | No public exploit | Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66. |
| CVE-2019-11235 | Critical | 2019-04-22 | Not applicable | No public exploit | FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499. |
| CVE-2019-11234 | Critical | 2019-04-22 | Not applicable | No public exploit | FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497. |
| CVE-2019-0160 | Critical | 2019-03-27 | Not applicable | No public exploit | Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access. |
| CVE-2019-9948 | Critical | 2019-03-23 | Not applicable | No public exploit | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call. |
| CVE-2019-9636 | Critical | 2019-03-08 | Not applicable | No public exploit | Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9. |
| CVE-2018-18498 | Critical | 2019-02-28 | Not applicable | No public exploit | A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64. |