WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product exchange server✕
Overview 121 matches · 0 in Waratek scope · 0 protected · 21 exploited · 14 CISA KEV · 26 public PoC · 27 EPSS ≥ 0.5
121matches 0in Waratek scope0.0% 0protected0.0% 21exploited17.4% 14CISA KEV11.6% 26public PoC21.5% 27EPSS ≥ 0.522.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 121 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 121 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 121 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 21 17.4% Working exploit published 7 5.8% Proof of concept only 5 4.1% Forecast only 5 4.1% No public exploit 83 68.6%
split by peak 25 / year
Not applicable: 121 High: 121 not blocked: 121 No public exploit: 83Forecast only: 5Proof of concept only: 5Working exploit published: 7Exploited: 21
19982 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 19991 Not applicable1 High1 not blocked1 No public exploit1 20000 20013 Not applicable3 High3 not blocked3 No public exploit3 20022 Not applicable2 High2 not blocked2 No public exploit2 20031 Not applicable1 High1 not blocked1 Working exploit published1 20042 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 20053 Not applicable3 High3 not blocked3 Working exploit published1 No public exploit2 20062 Not applicable2 High2 not blocked2 Forecast only1 No public exploit1 20073 Not applicable3 High3 not blocked3 Working exploit published1 No public exploit2 20080 20091 Not applicable1 High1 not blocked1 No public exploit1 20100 20110 20120 20130 20140 20150 20162 Not applicable2 High2 not blocked2 No public exploit2 20172 Not applicable2 High2 not blocked2 Exploited1 No public exploit1 20184 Not applicable4 High4 not blocked4 Exploited2 No public exploit2 20194 Not applicable4 High4 not blocked4 No public exploit4 20209 Not applicable9 High9 not blocked9 Exploited3 Forecast only1 No public exploit5 202116 Not applicable16 High16 not blocked16 Exploited10 Working exploit published1 No public exploit5 202210 Not applicable10 High10 not blocked10 Exploited2 Working exploit published1 No public exploit7 202325 Not applicable25 High25 not blocked25 Exploited2 Proof of concept only2 Forecast only3 No public exploit18 20242 Not applicable2 High2 not blocked2 Proof of concept only1 No public exploit1 20256 Not applicable6 High6 not blocked6 No public exploit6 202621 Not applicable21 High21 not blocked21 Exploited1 Proof of concept only2 No public exploit18
1999200220052008201120142017202020232026
121 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-87696 High 2026-10-13 Not applicable No public exploit Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-87695 High 2026-10-13 Not applicable No public exploit Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-87692 High 2026-10-13 Not applicable No public exploit Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-96940 High 2026-10-02 Not applicable No public exploit Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-69380 High 2026-09-08 Not applicable No public exploit Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-69378 High 2026-09-08 Not applicable No public exploit Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
CVE-2026-69355 High 2026-09-08 Not applicable No public exploit External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVE-2026-55007 High 2026-09-08 Not applicable No public exploit Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
CVE-2026-65813 High 2026-08-11 Not applicable No public exploit Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-62914 High 2026-08-11 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
CVE-2026-62913 High 2026-08-11 Not applicable No public exploit Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVE-2026-62911 High 2026-08-11 Not applicable Proof of concept only Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-62910 High 2026-08-11 Not applicable No public exploit Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-55009 High 2026-07-14 Not applicable No public exploit Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-55006 High 2026-07-14 Not applicable No public exploit Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-55005 High 2026-07-14 Not applicable No public exploit Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVE-2026-47631 High 2026-06-09 Not applicable No public exploit Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-45583 High 2026-06-09 Not applicable No public exploit Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
CVE-2026-45504 High 2026-06-09 Not applicable Proof of concept only Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-45503 High 2026-06-09 Not applicable No public exploit Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
CVE-2026-42897 High 2026-05-14 Not applicable Exploited Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-64666 High 2025-12-09 Not applicable No public exploit Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-59249 High 2025-10-14 Not applicable No public exploit Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-59248 High 2025-10-14 Not applicable No public exploit Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-53782 High 2025-10-14 Not applicable No public exploit Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.
CVE-2025-33051 High 2025-08-12 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
CVE-2025-53786 High 2025-08-06 Not applicable No public exploit On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.
CVE-2024-49040 High 2024-11-12 Not applicable Proof of concept only Microsoft Exchange Server Spoofing Vulnerability
CVE-2024-26198 High 2024-03-12 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36439 High 2023-11-14 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36050 High 2023-11-14 Not applicable No public exploit Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-36039 High 2023-11-14 Not applicable Forecast only Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-36035 High 2023-11-14 Not applicable Forecast only Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-36778 High 2023-10-10 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36757 High 2023-09-12 Not applicable No public exploit Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-36756 High 2023-09-12 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36745 High 2023-09-12 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36744 High 2023-09-12 Not applicable Forecast only Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-38185 High 2023-08-08 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-38182 High 2023-08-08 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-38181 High 2023-08-08 Not applicable No public exploit Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-35388 High 2023-08-08 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-35368 High 2023-08-08 Not applicable No public exploit Microsoft Exchange Remote Code Execution Vulnerability
CVE-2023-32031 High 2023-06-14 Not applicable Proof of concept only Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-28310 High 2023-06-14 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-21710 High 2023-02-14 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-21707 High 2023-02-14 Not applicable Proof of concept only Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-21706 High 2023-02-14 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-21529 High 2023-02-14 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-21764 High 2023-01-10 Not applicable No public exploit Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2023-21763 High 2023-01-10 Not applicable No public exploit Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2023-21762 High 2023-01-10 Not applicable No public exploit Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-21761 High 2023-01-10 Not applicable No public exploit Microsoft Exchange Server Information Disclosure Vulnerability
CVE-2023-21745 High 2023-01-10 Not applicable No public exploit Microsoft Exchange Server Spoofing Vulnerability
CVE-2022-41123 High 2022-11-09 Not applicable No public exploit Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-41079 High 2022-11-09 Not applicable No public exploit Microsoft Exchange Server Spoofing Vulnerability
CVE-2022-41078 High 2022-11-09 Not applicable No public exploit Microsoft Exchange Server Spoofing Vulnerability
CVE-2022-41082 High 2022-10-03 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2022-41040 High 2022-10-03 Not applicable Exploited Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-24516 High 2022-08-09 Not applicable No public exploit Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-24477 High 2022-08-09 Not applicable No public exploit Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-21980 High 2022-08-09 Not applicable No public exploit Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-21978 High 2022-05-10 Not applicable No public exploit Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-23277 High 2022-03-09 Not applicable Working exploit published Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-42321 High 2021-11-10 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-41348 High 2021-10-13 Not applicable No public exploit Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2021-34453 High 2021-10-13 Not applicable No public exploit Microsoft Exchange Server Denial of Service Vulnerability
CVE-2021-34470 High 2021-07-14 Not applicable Exploited Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2021-33768 High 2021-07-14 Not applicable Exploited Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2021-33766 High 2021-07-14 Not applicable Exploited Microsoft Exchange Server Information Disclosure Vulnerability
CVE-2021-31206 High 2021-07-14 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-31196 High 2021-07-14 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-31209 High 2021-05-11 Not applicable No public exploit Microsoft Exchange Server Spoofing Vulnerability
CVE-2021-31198 High 2021-05-11 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-31195 High 2021-05-11 Not applicable Working exploit published Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-28482 High 2021-04-13 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-27065 High 2021-03-03 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26858 High 2021-03-03 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26857 High 2021-03-03 Not applicable Exploited Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26854 High 2021-03-03 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2020-17144 High 2020-12-10 Not applicable Exploited Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17143 High 2020-12-10 Not applicable Forecast only Microsoft Exchange Server Information Disclosure Vulnerability
CVE-2020-17141 High 2020-12-10 Not applicable No public exploit Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17117 High 2020-12-10 Not applicable No public exploit Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17084 High 2020-11-11 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2020-16969 High 2020-10-16 Not applicable No public exploit <p>An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.</p> <p>To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.</p> <p>The security update corrects the way that Exchange handles these token validations.</p>
CVE-2020-16875 High 2020-09-11 Not applicable Exploited <p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p> <p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.</p>
CVE-2020-0692 High 2020-02-11 Not applicable No public exploit An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.
CVE-2020-0688 High 2020-02-11 Not applicable Exploited A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
CVE-2019-1233 High 2019-09-11 Not applicable No public exploit A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Denial of Service Vulnerability'.
CVE-2019-1136 High 2019-07-15 Not applicable No public exploit An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.
CVE-2019-0724 High 2019-03-05 Not applicable No public exploit An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0686.
CVE-2019-0686 High 2019-03-05 Not applicable No public exploit An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0724.
CVE-2018-8581 High 2018-11-14 Not applicable Exploited An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-8265 High 2018-10-10 Not applicable No public exploit A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Code Execution Vulnerability." This affects Microsoft Exchange Server.
CVE-2018-16793 High 2018-09-21 Not applicable No public exploit Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.
CVE-2018-0986 High 2018-04-04 Not applicable Exploited A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability." This affects Windows Defender, Windows Intune Endpoint Protection, Microsoft Security Essentials, Microsoft System Center Endpoint Protection, Microsoft Exchange Server, Microsoft System Center, Microsoft Forefront Endpoint Protection.
CVE-2017-11932 High 2017-12-12 Not applicable No public exploit Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web requests, aka "Microsoft Exchange Spoofing Vulnerability".
CVE-2017-8540 High 2017-05-26 Not applicable Exploited The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability", a different vulnerability than CVE-2017-8538 and CVE-2017-8541.
CVE-2016-3378 High 2016-09-14 Not applicable No public exploit Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "Microsoft Exchange Open Redirect Vulnerability."
‹ prev page 1 of 2 next ›