Overview 31 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
31matches
0in Waratek scope0.0%
0protected0.0%
1exploited3.2%
1CISA KEV3.2%
1public PoC3.2%
1EPSS ≥ 0.53.2%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
3.2%
Not applicable
30
96.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
31
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
3.2%
Working exploit published
0
0.0%
Proof of concept only
1
3.2%
Forecast only
0
0.0%
No public exploit
29
93.5%
split by
peak 13 / year
20191
Not applicable1
High1
not blocked1
No public exploit1
20202
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20211
Not applicable1
Medium1
not blocked1
No public exploit1
20221
Not applicable1
High1
not blocked1
No public exploit1
20234
Outside Waratek scope1
Not applicable3
High3
Medium1
not blocked4
Exploited1
No public exploit3
20246
Not applicable6
Critical3
Medium3
not blocked6
Proof of concept only1
No public exploit5
20253
Not applicable3
High2
Low1
not blocked3
No public exploit3
202613
Not applicable13
Critical4
High6
Medium3
not blocked13
No public exploit13
20192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-69559 | Medium | 2026-09-08 | Not applicable | No public exploit | Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
| CVE-2026-65812 | Medium | 2026-09-08 | Not applicable | No public exploit | Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
| CVE-2026-65769 | High | 2026-08-11 | Not applicable | No public exploit | Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-65768 | Critical | 2026-08-11 | Not applicable | No public exploit | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network. |
| CVE-2026-65767 | High | 2026-08-11 | Not applicable | No public exploit | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-65667 | Critical | 2026-08-07 | Not applicable | No public exploit | Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-62918 | High | 2026-08-07 | Not applicable | No public exploit | Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-62896 | Critical | 2026-08-07 | Not applicable | No public exploit | Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-42835 | High | 2026-06-09 | Not applicable | No public exploit | Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
| CVE-2026-32185 | Medium | 2026-05-12 | Not applicable | No public exploit | Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally. |
| CVE-2026-33823 | Critical | 2026-05-07 | Not applicable | No public exploit | Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network. |
| CVE-2026-26133 | High | 2026-03-16 | Not applicable | No public exploit | AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-21535 | High | 2026-02-19 | Not applicable | No public exploit | Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network. |
| CVE-2025-53783 | High | 2025-08-12 | Not applicable | No public exploit | Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network. |
| CVE-2025-49737 | High | 2025-07-08 | Not applicable | No public exploit | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally. |
| CVE-2025-49731 | Low | 2025-07-08 | Not applicable | No public exploit | Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network. |
| CVE-2024-42004 | Critical | 2024-12-18 | Not applicable | Proof of concept only | A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions. |
| CVE-2024-41145 | Critical | 2024-12-18 | Not applicable | No public exploit | A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions. |
| CVE-2024-41138 | Critical | 2024-12-18 | Not applicable | No public exploit | A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions. |
| CVE-2024-38197 | Medium | 2024-08-13 | Not applicable | No public exploit | Microsoft Teams for iOS Spoofing Vulnerability |
| CVE-2024-21448 | Medium | 2024-03-12 | Not applicable | No public exploit | Microsoft Teams for Android Information Disclosure Vulnerability |
| CVE-2024-21374 | Medium | 2024-02-13 | Not applicable | No public exploit | Microsoft Teams for Android Information Disclosure Vulnerability |
| CVE-2023-4863 | High | 2023-09-12 | Outside Waratek scope | Exploited | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2023-29330 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Teams Remote Code Execution Vulnerability |
| CVE-2023-29328 | High | 2023-08-08 | Not applicable | No public exploit | Microsoft Teams Remote Code Execution Vulnerability |
| CVE-2023-24881 | Medium | 2023-07-11 | Not applicable | No public exploit | Microsoft Teams Information Disclosure Vulnerability |
| CVE-2022-21965 | High | 2022-02-09 | Not applicable | No public exploit | Microsoft Teams Denial of Service Vulnerability |
| CVE-2021-24114 | Medium | 2021-02-25 | Not applicable | No public exploit | Microsoft Teams iOS Information Disclosure Vulnerability |
| CVE-2020-10146 | Medium | 2020-12-09 | Not applicable | No public exploit | The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to obtain sensitive information such as authentication tokens and to possibly execute arbitrary commands. This vulnerability was fixed for all Teams users in the online service on or around October 2020. |
| CVE-2020-17091 | High | 2020-11-11 | Not applicable | No public exploit | Microsoft Teams Remote Code Execution Vulnerability |
| CVE-2019-5922 | High | 2019-03-12 | Not applicable | No public exploit | Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. |