Overview 23 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
23matches
1in Waratek scope4.3%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
4public PoC17.4%
2EPSS ≥ 0.58.7%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
4.3%
Outside Waratek scope
2
8.7%
Not applicable
20
87.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
23
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
4
17.4%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
19
82.6%
split by
peak 8 / year
20001
Not applicable1
Medium1
not blocked1
Working exploit published1
20013
Outside Waratek scope1
Not applicable2
High2
Medium1
not blocked3
Working exploit published1
No public exploit2
20021
Not applicable1
Medium1
not blocked1
No public exploit1
20030
20044
Not applicable4
High2
Medium2
not blocked4
Working exploit published1
No public exploit3
20050
20060
20070
20080
20090
20101
Outside Waratek scope1
High1
not blocked1
Working exploit published1
20111
Not applicable1
Medium1
not blocked1
No public exploit1
20121
No exploit published1
High1
not blocked1
No public exploit1
20130
20140
20151
Not applicable1
High1
not blocked1
No public exploit1
20160
20170
20180
20190
20200
20210
20220
20232
Not applicable2
High2
not blocked2
No public exploit2
20240
20250
20268
Not applicable8
Critical3
High5
not blocked8
No public exploit8
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-9170 | Critical | 2026-05-26 | Not applicable | No public exploit | IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service and a potential remote code execution due to improper input validation. |
| CVE-2026-8856 | Critical | 2026-05-26 | Not applicable | No public exploit | IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration. |
| CVE-2026-8855 | Critical | 2026-05-26 | Not applicable | No public exploit | IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication). |
| CVE-2026-8854 | High | 2026-05-26 | Not applicable | No public exploit | IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_mem_cache. |
| CVE-2026-8852 | High | 2026-05-26 | Not applicable | No public exploit | IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_fastcgi module. |
| CVE-2026-8850 | High | 2026-05-26 | Not applicable | No public exploit | IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service via the optional module mod_ibm_upload. |
| CVE-2026-8835 | High | 2026-05-26 | Not applicable | No public exploit | IBM HTTP Server 8.5, and 9.0 is vulnerable to invalid pointer dereference. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to expose sensitive information or cause a denial of service. |
| CVE-2026-8834 | High | 2026-05-26 | Not applicable | No public exploit | IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability. A privileged user, authenticated to the Administration Server, could exploit this vulnerability to execute remote code or cause a denial of service. |
| CVE-2023-32342 | High | 2023-05-30 | Not applicable | No public exploit | IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending an overly large number of trial messages for decryption, an attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 255828. |
| CVE-2023-26281 | High | 2023-03-01 | Not applicable | No public exploit | IBM HTTP Server 8.5 used by IBM WebSphere Application Server could allow a remote user to cause a denial of service using a specially crafted URL. IBM X-Force ID: 248296. |
| CVE-2015-4947 | High | 2015-09-15 | Not applicable | No public exploit | Stack-based buffer overflow in the Administration Server in IBM HTTP Server 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7, as used in WebSphere Application Server and other products, allows remote authenticated users to execute arbitrary code via unspecified vectors. |
| CVE-2012-5955 | High | 2012-12-20 | No exploit published | No public exploit | Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows remote attackers to execute arbitrary commands via unknown vectors. |
| CVE-2011-1360 | Medium | 2011-10-28 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier, as used in WebSphere Application Server and other products, allow remote attackers to inject arbitrary web script or HTML via vectors involving unspecified documentation files in (1) manual/ibm/ and (2) htdocs/*/manual/ibm/. |
| CVE-2010-0425 | High | 2010-03-05 | Outside Waratek scope | Working exploit published | modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers." |
| CVE-2004-0263 | Medium | 2004-11-23 | Not applicable | No public exploit | PHP 4.3.4 and earlier in Apache 1.x and 2.x (mod_php) can leak global variables between virtual hosts that are handled by the same Apache child process but have different settings, which could allow remote attackers to obtain sensitive information. |
| CVE-2004-0493 | Medium | 2004-08-06 | Not applicable | Working exploit published | The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters. |
| CVE-2004-0492 | High | 2004-08-06 | Not applicable | No public exploit | Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied. |
| CVE-2004-1082 | High | 2004-02-03 | Not applicable | No public exploit | mod_digest_apple for Apache 1.3.31 and 1.3.32 on Mac OS X Server does not properly verify the nonce of a client response, which allows remote attackers to replay credentials. |
| CVE-2002-1822 | Medium | 2002-12-31 | Not applicable | No public exploit | IBM HTTP Server 1.0 on AS/400 allows remote attackers to obtain the path to the web root directory and other sensitive information, which is leaked in an error mesage when a request is made for a non-existent Java Server Page (JSP). |
| CVE-2000-1202 | High | 2001-08-31 | Not applicable | No public exploit | ikeyman in IBM IBMHSSSB 1.0 sets the CLASSPATH environmental variable to include the user's own CLASSPATH directories before the system's directories, which allows a malicious local user to execute arbitrary code as root via a Trojan horse Ikeyman class. |
| CVE-2001-0122 | Medium | 2001-03-13 | Outside Waratek scope | Working exploit published | Kernel leak in AfpaCache module of the Fast Response Cache Accelerator (FRCA) component of IBM HTTP Server 1.3.x and Websphere 3.52 allows remote attackers to cause a denial of service via a series of malformed HTTP requests that generate a "bad request" error. |
| CVE-2000-1168 | High | 2001-01-09 | Not applicable | No public exploit | IBM HTTP Server 1.3.6 (based on Apache) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long GET request. |
| CVE-2000-0505 | Medium | 2000-05-31 | Not applicable | Working exploit published | The Apache 1.3.x HTTP server for Windows platforms allows remote attackers to list directory contents by requesting a URL containing a large number of / characters. |