Overview 64 matches · 2 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
64matches
2in Waratek scope3.1%
1protected1.6%
0exploited0.0%
0CISA KEV0.0%
2public PoC3.1%
1EPSS ≥ 0.51.6%
Protected by Waratek
1
1.6%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
1.6%
Outside Waratek scope
0
0.0%
Not applicable
62
96.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
1.6%
partly blocked
0
0.0%
not blocked
63
98.4%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
2
3.1%
Proof of concept only
2
3.1%
Forecast only
0
0.0%
No public exploit
60
93.8%
split by
peak 18 / year
20011
Not applicable1
High1
not blocked1
Working exploit published1
20021
Not applicable1
High1
not blocked1
No public exploit1
20031
Not applicable1
High1
not blocked1
Working exploit published1
20040
20050
20060
20070
20080
20090
20100
20110
20120
20130
20140
20150
20160
20170
20181
Not applicable1
High1
not blocked1
No public exploit1
20193
Not applicable3
High3
not blocked3
No public exploit3
202011
Not applicable11
High11
not blocked11
No public exploit11
202114
Not applicable14
High14
not blocked14
No public exploit14
202218
Not applicable18
High18
not blocked18
No public exploit18
20235
Protected by Waratek1
Not applicable4
High5
blocked by ARMR today1
not blocked4
Proof of concept only1
No public exploit4
20245
No exploit published1
Not applicable4
High5
not blocked5
Proof of concept only1
No public exploit4
20251
Not applicable1
High1
not blocked1
No public exploit1
20263
Not applicable3
High3
not blocked3
No public exploit3
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-81352 | High | 2026-09-08 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. |
| CVE-2026-58600 | High | 2026-09-08 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-58599 | High | 2026-09-08 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally. |
| CVE-2024-13311 | High | 2025-01-09 | Not applicable | No public exploit | Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*. |
| CVE-2024-52471 | High | 2024-11-20 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor allows Reflected XSS.This issue affects Extensions for Elementor: from n/a through 2.0.37. |
| CVE-2024-47878 | High | 2024-10-24 | No exploit published | Proof of concept only | OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `<script>` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as if it was part of OpenRefine. Version 3.8.3 fixes this issue. |
| CVE-2024-29102 | High | 2024-03-19 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes Extensions For CF7 allows Stored XSS.This issue affects Extensions For CF7: from n/a through 3.0.6. |
| CVE-2024-21643 | High | 2024-01-10 | Not applicable | No public exploit | IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher. |
| CVE-2023-51539 | High | 2024-01-05 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.1. |
| CVE-2023-6836 | High | 2023-12-15 | Protected by Waratek | No public exploit | Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information. |
| CVE-2023-31074 | High | 2023-08-17 | Not applicable | No public exploit | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in hupe13 Extensions for Leaflet Map plugin <= 3.4.1 versions. |
| CVE-2023-38170 | High | 2023-08-08 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2023-36476 | High | 2023-06-29 | Not applicable | No public exploit | calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Users of calamares-nixos-extensions version 0.3.12 and prior who installed NixOS through the graphical calamares installer, with an unencrypted `/boot`, on either non-UEFI systems or with a LUKS partition different from `/` have their LUKS key file in `/boot` as a plaintext CPIO archive attached to their NixOS initrd. A patch is available and anticipated to be part of version 0.3.13 to backport to NixOS 22.11, 23.05, and unstable channels. Expert users who have a copy of their data may, as a workaround, re-encrypt the LUKS partition(s) themselves. |
| CVE-2023-32309 | High | 2023-05-15 | Not applicable | Proof of concept only | PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. In affected versions an arbitrary file read is possible when using include file syntax. By using the syntax `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to render the content of a file outside the specified base paths: `--8<-- "../../../../etc/passwd"`. Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to Directory Traversal. The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in snippets.py. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. It is never recommended to use Snippets to process user-facing, dynamic content. It is designed to process known content on the backend under the control of the host, but if someone were to accidentally enable it for user-facing content, undesired information could be exposed. This issue has been addressed in version 10.0. Users are advised to upgrade. Users unable to upgrade may restrict relative paths by filtering input. |
| CVE-2022-30188 | High | 2022-06-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-29119 | High | 2022-06-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-29111 | High | 2022-06-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-22018 | High | 2022-06-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24532 | High | 2022-04-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24501 | High | 2022-03-09 | Not applicable | No public exploit | VP9 Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24456 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24453 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24452 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-24451 | High | 2022-03-09 | Not applicable | No public exploit | VP9 Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-23301 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-22007 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-22006 | High | 2022-03-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-22709 | High | 2022-02-09 | Not applicable | No public exploit | VP9 Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-21927 | High | 2022-02-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-21926 | High | 2022-02-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-21844 | High | 2022-02-09 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2022-21917 | High | 2022-01-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-41360 | High | 2021-12-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-40453 | High | 2021-12-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-40452 | High | 2021-12-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-38661 | High | 2021-09-15 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-33778 | High | 2021-07-14 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-33777 | High | 2021-07-14 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-33776 | High | 2021-07-14 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-33775 | High | 2021-07-14 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-31947 | High | 2021-07-14 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-31967 | High | 2021-06-08 | Not applicable | No public exploit | VP9 Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-28465 | High | 2021-05-11 | Not applicable | No public exploit | Web Media Extensions Remote Code Execution Vulnerability |
| CVE-2021-28464 | High | 2021-04-13 | Not applicable | No public exploit | VP9 Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-1644 | High | 2021-01-12 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2021-1643 | High | 2021-01-12 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-17110 | High | 2020-11-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-17109 | High | 2020-11-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-17108 | High | 2020-11-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-17107 | High | 2020-11-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-17106 | High | 2020-11-11 | Not applicable | No public exploit | HEVC Video Extensions Remote Code Execution Vulnerability |
| CVE-2020-7668 | High | 2020-06-23 | Not applicable | No public exploit | In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide. |
| CVE-2020-7664 | High | 2020-06-23 | Not applicable | No public exploit | In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide. |
| CVE-2020-7663 | High | 2020-06-02 | Not applicable | No public exploit | websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. |
| CVE-2020-7662 | High | 2020-06-02 | Not applicable | No public exploit | websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header. |
| CVE-2020-6236 | High | 2020-04-14 | Not applicable | No public exploit | SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including S-user ID bit s-bit) of arbitrary files remotely. This results in the possibility to execute these files as root user from a non-root context, leading to Privilege Escalation. |
| CVE-2020-0561 | High | 2020-02-13 | Not applicable | No public exploit | Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2019-14566 | High | 2019-11-14 | Not applicable | No public exploit | Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access. |
| CVE-2019-14565 | High | 2019-11-14 | Not applicable | No public exploit | Insufficient initialization in Intel(R) SGX SDK Windows versions 2.4.100.51291 and earlier, and Linux versions 2.6.100.51363 and earlier, may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access. |
| CVE-2019-0122 | High | 2019-03-14 | Not applicable | No public exploit | Double free in Intel(R) SGX SDK for Linux before version 2.2 and Intel(R) SGX SDK for Windows before version 2.1 may allow an authenticated user to potentially enable information disclosure or denial of service via local access. |
| CVE-2017-5736 | High | 2018-03-20 | Not applicable | No public exploit | An elevation of privilege in Intel Software Guard Extensions Platform Software Component before 1.9.105.42329 allows a local attacker to execute arbitrary code as administrator. |
| CVE-2003-0822 | High | 2003-12-15 | Not applicable | Working exploit published | Buffer overflow in the debug functionality in fp30reg.dll of Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to execute arbitrary code via a crafted chunked encoded request. |
| CVE-2002-0692 | High | 2002-10-10 | Not applicable | No public exploit | Buffer overflow in SmartHTML Interpreter (shtml.dll) in Microsoft FrontPage Server Extensions (FPSE) 2000 and 2002 allows remote attackers to cause a denial of service (CPU consumption) or run arbitrary code, respectively, via a certain type of web file request. |
| CVE-2001-0341 | High | 2001-07-21 | Not applicable | Working exploit published | Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbitrary commands via a long registration request (URL) to fp30reg.dll. |