WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product sentry✕
Overview 14 matches · 0 in Waratek scope · 0 protected · 3 exploited · 3 CISA KEV · 3 public PoC · 4 EPSS ≥ 0.5
14matches 0in Waratek scope0.0% 0protected0.0% 3exploited21.4% 3CISA KEV21.4% 3public PoC21.4% 4EPSS ≥ 0.528.6%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 14 100.0% Withdrawn CVE 0 0.0%
Critical 14 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 21.4% Working exploit published 0 0.0% Proof of concept only 2 14.3% Forecast only 1 7.1% No public exploit 8 57.1%
split by peak 5 / year
Not applicable: 14 Critical: 14 not blocked: 14 No public exploit: 8Forecast only: 1Proof of concept only: 2Exploited: 3
20161 Not applicable1 Critical1 not blocked1 No public exploit1 20170 20181 Not applicable1 Critical1 not blocked1 No public exploit1 20190 20204 Not applicable4 Critical4 not blocked4 Exploited1 No public exploit3 20210 20220 20232 Not applicable2 Critical2 not blocked2 Exploited1 No public exploit1 20240 20251 Not applicable1 Critical1 not blocked1 Proof of concept only1 20265 Not applicable5 Critical5 not blocked5 Exploited1 Proof of concept only1 Forecast only1 No public exploit2
20162017201820192020202120222023202420252026
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-10523 Critical 2026-06-09 Not applicable Forecast only An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access
CVE-2026-10520 Critical 2026-06-09 Not applicable Exploited An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution
CVE-2026-42354 Critical 2026-05-08 Not applicable No public exploit Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.
CVE-2026-27197 Critical 2026-02-21 Not applicable No public exploit Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. Self-hosted users are only at risk if the following criteria is met: ore than one organizations are configured (SENTRY_SINGLE_ORGANIZATION = True), or malicious user has existing access and permissions to modify SSO settings for another organization in a multo-organization instance. This issue has been fixed in version 26.2.0. To workaround this issue, implement user account-based two-factor authentication to prevent an attacker from being able to complete authentication with a victim's user account. Organization administrators cannot do this on a user's behalf, this requires individual users to ensure 2FA has been enabled for their account.
CVE-2019-25278 Critical 2026-01-08 Not applicable Proof of concept only FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. Attackers can perform man-in-the-middle attacks to capture HTTP cookie authentication information during network communication.
CVE-2019-25241 Critical 2025-12-24 Not applicable Proof of concept only FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.
CVE-2023-46729 Critical 2023-11-10 Not applicable No public exploit sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunneling feature enabled. The problem has been fixed in version 7.77.0.
CVE-2023-38035 Critical 2023-08-21 Not applicable Exploited A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CVE-2020-15506 Critical 2020-07-07 Not applicable No public exploit An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to bypass authentication mechanisms via unspecified vectors.
CVE-2020-15505 Critical 2020-07-07 Not applicable Exploited A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2013-7287 Critical 2020-02-13 Not applicable No public exploit MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme.
CVE-2014-1409 Critical 2020-01-08 Not applicable No public exploit MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords
CVE-2018-9031 Critical 2018-03-29 Not applicable No public exploit The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side.
CVE-2016-4520 Critical 2016-07-15 Not applicable No public exploit Schneider Electric Pelco Digital Sentry Video Management System with firmware before 7.14 has hardcoded credentials, which allows remote attackers to obtain access, and consequently execute arbitrary code, via unspecified vectors.