Overview 852 matches · 81 in Waratek scope · 14 protected · 24 exploited · 13 CISA KEV · 45 public PoC · 21 EPSS ≥ 0.5
852matches
81in Waratek scope9.5%
14protected1.6%
24exploited2.8%
13CISA KEV1.5%
45public PoC5.3%
21EPSS ≥ 0.52.5%
Protected by Waratek
14
1.6%
Rule in development
0
0.0%
Mitigation candidate
3
0.4%
No exploit published
64
7.5%
Outside Waratek scope
20
2.3%
Not applicable
751
88.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
14
1.6%
partly blocked
0
0.0%
not blocked
838
98.4%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 123 / year
19981
Not applicable1
High1
not blocked1
No public exploit1
19991
Not applicable1
High1
not blocked1
No public exploit1
20002
Not applicable2
High2
not blocked2
Working exploit published2
20010
20020
20031
Not applicable1
High1
not blocked1
No public exploit1
20040
20051
Not applicable1
High1
not blocked1
No public exploit1
20065
Protected by Waratek1
No exploit published1
Not applicable3
High5
blocked by ARMR today1
not blocked4
Working exploit published1
No public exploit4
20070
20085
Not applicable5
High5
not blocked5
Working exploit published3
No public exploit2
20092
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
20100
20111
Not applicable1
High1
not blocked1
No public exploit1
20122
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
201312
No exploit published5
Not applicable7
High12
not blocked12
Exploited1
Working exploit published1
No public exploit10
20148
Protected by Waratek1
Not applicable7
High8
blocked by ARMR today1
not blocked7
Exploited2
Working exploit published2
No public exploit4
20157
Not applicable7
High7
not blocked7
Exploited1
Working exploit published1
No public exploit5
201613
Not applicable13
High13
not blocked13
Exploited1
No public exploit12
201729
No exploit published4
Outside Waratek scope2
Not applicable23
High29
not blocked29
Exploited1
Working exploit published1
Proof of concept only1
No public exploit26
201852
No exploit published7
Outside Waratek scope3
Not applicable42
High52
not blocked52
Exploited3
Working exploit published3
Forecast only1
No public exploit45
201965
Protected by Waratek2
No exploit published4
Outside Waratek scope2
Not applicable57
High65
blocked by ARMR today2
not blocked63
Working exploit published1
Proof of concept only2
Forecast only2
No public exploit60
202063
Mitigation candidate1
No exploit published10
Not applicable52
High63
not blocked63
Proof of concept only1
No public exploit62
202165
Protected by Waratek1
No exploit published6
Outside Waratek scope9
Not applicable49
High65
blocked by ARMR today1
not blocked64
Exploited6
Working exploit published2
Proof of concept only1
No public exploit56
202267
Protected by Waratek2
No exploit published3
Outside Waratek scope3
Not applicable59
High67
blocked by ARMR today2
not blocked65
Exploited1
Working exploit published1
Forecast only3
No public exploit62
2023115
Protected by Waratek5
Mitigation candidate2
No exploit published9
Not applicable99
High115
blocked by ARMR today5
not blocked110
Exploited7
Working exploit published2
Proof of concept only4
Forecast only1
No public exploit101
2024123
Protected by Waratek1
No exploit published5
Outside Waratek scope1
Not applicable116
High123
blocked by ARMR today1
not blocked122
Proof of concept only2
No public exploit121
2025116
No exploit published5
Not applicable111
High116
not blocked116
Proof of concept only2
No public exploit114
202696
Protected by Waratek1
No exploit published5
Not applicable90
High96
blocked by ARMR today1
not blocked95
Exploited1
Proof of concept only1
No public exploit94
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-75061 | High | 2026-10-12 | Not applicable | No public exploit | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system. |
| CVE-2026-19627 | High | 2026-10-12 | Not applicable | No public exploit | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths. |
| CVE-2026-19620 | High | 2026-10-12 | Not applicable | No public exploit | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication. |
| CVE-2026-17475 | High | 2026-10-12 | Not applicable | No public exploit | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control. |
| CVE-2026-57554 | High | 2026-10-06 | Not applicable | No public exploit | Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations. |
| CVE-2026-25302 | High | 2026-10-06 | Not applicable | No public exploit | Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed. |
| CVE-2026-25267 | High | 2026-10-06 | Not applicable | No public exploit | Memory corruption when non-secure loader rewrites page tables before secure memory initialization. |
| CVE-2026-103009 | High | 2026-10-06 | Not applicable | No public exploit | Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index's document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index. |
| CVE-2026-103007 | High | 2026-10-06 | Not applicable | No public exploit | Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster. |
| CVE-2026-76715 | High | 2026-09-22 | Not applicable | No public exploit | A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected appliance. |
| CVE-2026-76714 | High | 2026-09-22 | Not applicable | No public exploit | Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise. |
| CVE-2026-76713 | High | 2026-09-22 | Not applicable | No public exploit | A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full system compromise. |
| CVE-2026-76712 | High | 2026-09-22 | Not applicable | No public exploit | A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications. Successful exploitation could result in the disclosure of sensitive information, bypass of security controls, or a denial of service condition on the affected system. |
| CVE-2026-76711 | High | 2026-09-22 | Not applicable | No public exploit | A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful exploitation could result in unauthorized data injection. |
| CVE-2026-76710 | High | 2026-09-22 | Not applicable | No public exploit | A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful exploitation could result in the disclosure of sensitive site hierarchy, infrastructure details, and client device information. |
| CVE-2026-25275 | High | 2026-09-17 | Not applicable | No public exploit | Transient DOS when processing authentication frames with invalid FILS information element header lengths. |
| CVE-2026-69805 | High | 2026-09-08 | Not applicable | No public exploit | External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-78607 | High | 2026-09-01 | Not applicable | No public exploit | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed. |
| CVE-2026-72649 | High | 2026-09-01 | Not applicable | No public exploit | Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models. |
| CVE-2026-71051 | High | 2026-08-18 | No exploit published | No public exploit | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). |
| CVE-2026-71050 | High | 2026-08-18 | No exploit published | No public exploit | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows high privileged attacker with network access via Oracle Net to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Lifecycle Analytics accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N). |
| CVE-2026-71049 | High | 2026-08-18 | No exploit published | No public exploit | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). |
| CVE-2026-71048 | High | 2026-08-18 | No exploit published | No public exploit | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Product Lifecycle Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L). |
| CVE-2026-72642 | High | 2026-08-13 | Not applicable | No public exploit | The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process. |
| CVE-2026-13365 | High | 2026-08-13 | Not applicable | No public exploit | IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. |
| CVE-2026-25292 | High | 2026-08-04 | Not applicable | No public exploit | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration. |
| CVE-2026-24079 | High | 2026-08-04 | Not applicable | No public exploit | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. |
| CVE-2026-10545 | High | 2026-07-30 | Not applicable | No public exploit | IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions. |
| CVE-2026-56455 | High | 2026-07-16 | Not applicable | No public exploit | HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive. To mitigate this flaw, comprehensive input length checks must be implemented and enforced on both the client and server sides. |
| CVE-2026-56454 | High | 2026-07-16 | Not applicable | No public exploit | HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1.0 and TLS 1.1, and exclusively enable support for secure protocols, specifically TLS 1.2 and TLS 1.3. |
| CVE-2026-35142 | High | 2026-07-16 | Not applicable | No public exploit | HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks. |
| CVE-2026-35140 | High | 2026-07-16 | Not applicable | No public exploit | HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels. |
| CVE-2026-47835 | High | 2026-06-15 | No exploit published | No public exploit | In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8). |
| CVE-2026-24092 | High | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when processing fastboot commands to set display mode. |
| CVE-2026-24091 | High | 2026-06-01 | Not applicable | No public exploit | Memory corruption while processing fastboot commands with improperly formatted input. |
| CVE-2026-24090 | High | 2026-06-01 | Not applicable | No public exploit | Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow. |
| CVE-2026-24089 | High | 2026-06-01 | Not applicable | No public exploit | Memory corruption while processing fastboot commands with invalid input. |
| CVE-2026-24087 | High | 2026-06-01 | Not applicable | No public exploit | Memory corruption while processing fastboot OEM commands. |
| CVE-2026-24085 | High | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when processing display command line information due to improper initialization of a variable. |
| CVE-2025-59605 | High | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when processing device identifier strings that exceed the expected maximum length. |
| CVE-2025-59604 | High | 2026-06-01 | Not applicable | No public exploit | Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer. |
| CVE-2026-7365 | High | 2026-05-27 | Not applicable | No public exploit | IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication. |
| CVE-2026-2253 | High | 2026-05-27 | Protected by Waratek | No public exploit | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities. |
| CVE-2025-3633 | High | 2026-05-27 | Not applicable | No public exploit | IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS). This vulnerability allows a remote attacker to inject arbitrary JavaScript code into the web user interface, which may alter the intended functionality and could lead to the disclosure of credentials within a trusted session. |
| CVE-2025-36126 | High | 2026-05-26 | Not applicable | No public exploit | IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos Adminstration. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
| CVE-2026-25193 | High | 2026-05-25 | Not applicable | No public exploit | Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre. |
| CVE-2026-42937 | High | 2026-05-13 | Not applicable | No public exploit | Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view adjacent network information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-42930 | High | 2026-05-13 | Not applicable | No public exploit | When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-42924 | High | 2026-05-13 | Not applicable | No public exploit | An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-42920 | High | 2026-05-13 | Not applicable | No public exploit | When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-42919 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in BIG-IP systems that may allow an authenticated attacker with administrative access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-42781 | High | 2026-05-13 | Not applicable | No public exploit | When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-42409 | High | 2026-05-13 | Not applicable | No public exploit | When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-42406 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-41959 | High | 2026-05-13 | Not applicable | No public exploit | Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) network diagnostics commands and in BIG-IP iControl REST. These vulnerabilities may allow an authenticated attacker to view the network status of destination systems. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-41957 | High | 2026-05-13 | Not applicable | No public exploit | An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-IP and BIG-IQ Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-41956 | High | 2026-05-13 | Not applicable | No public exploit | When a classification profile is configured on a UDP virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-41953 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in BIG-IP systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can modify configuration objects resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-41225 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in iControl REST where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-41219 | High | 2026-05-13 | Not applicable | No public exploit | An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView file. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated |
| CVE-2026-41218 | High | 2026-05-13 | Not applicable | No public exploit | When BIG-IP PEM iRules are configured on a virtual server (iRules using commands starting with CLASSIFICATION::, CLASSIFY::, PEM::, PSC::, and the urlcatquery command), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-41217 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in an undisclosed BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with resource administrator or administrator role to execute arbitrary system commands with higher privileges. In Appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-40699 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-40698 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Resource Administrator role can create SNMP configuration objects through iControl REST or the TMOS shell (tmsh) resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-40631 | High | 2026-05-13 | Not applicable | No public exploit | An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-40629 | High | 2026-05-13 | Not applicable | No public exploit | When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-40618 | High | 2026-05-13 | Not applicable | No public exploit | When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-40462 | High | 2026-05-13 | Not applicable | No public exploit | Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-40423 | High | 2026-05-13 | Not applicable | No public exploit | When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-39459 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly privileged, authenticated attacker with at least the Manager role can create configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-39458 | High | 2026-05-13 | Not applicable | No public exploit | When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-39455 | High | 2026-05-13 | Not applicable | No public exploit | When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol (LDAP) authentication, undisclosed traffic can cause the httpd process to exhaust the available file descriptors. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-35062 | High | 2026-05-13 | Not applicable | No public exploit | An authenticated iControl SOAP user may be able to obtain information of other accounts. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-34176 | High | 2026-05-13 | Not applicable | No public exploit | When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-32673 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in BIG-IP scripted monitors that may allow an authenticated attacker with the Resource Administrator or Administrator role to execute arbitrary system commands with higher privileges. In appliance mode deployments, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-32643 | High | 2026-05-13 | Not applicable | No public exploit | A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager role can modify configuration objects that allow running arbitrary commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
| CVE-2026-24082 | High | 2026-05-04 | Not applicable | No public exploit | Memory Corruption when copying data from a freed source while executing performance counter deselect operation. |
| CVE-2025-47404 | High | 2026-05-04 | Not applicable | No public exploit | Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified. |
| CVE-2025-47401 | High | 2026-05-04 | Not applicable | No public exploit | Transient DOS when processing target power rate tables during channel configuration. |
| CVE-2025-47392 | High | 2026-04-06 | Not applicable | No public exploit | Memory corruption when decoding corrupted satellite data files with invalid signature offsets. |
| CVE-2025-47389 | High | 2026-04-06 | Not applicable | No public exploit | Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation. |
| CVE-2026-2072 | High | 2026-03-25 | Not applicable | No public exploit | Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00. |
| CVE-2026-21385 | High | 2026-03-02 | Not applicable | Exploited | Memory corruption while using alignments for memory allocation. |
| CVE-2025-47386 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs. |
| CVE-2025-47383 | High | 2026-03-02 | Not applicable | No public exploit | Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE. |
| CVE-2025-47379 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources. |
| CVE-2025-47377 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls. |
| CVE-2025-47376 | High | 2026-03-02 | Not applicable | No public exploit | Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls. |
| CVE-2025-47375 | High | 2026-03-02 | Not applicable | No public exploit | Memory corruption while handling different IOCTL calls from the user-space simultaneously. |
| CVE-2025-47398 | High | 2026-02-02 | Not applicable | No public exploit | Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers. |
| CVE-2025-47397 | High | 2026-02-02 | Not applicable | No public exploit | Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors. |
| CVE-2025-47366 | High | 2026-02-02 | Not applicable | No public exploit | Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input. |
| CVE-2026-22850 | High | 2026-01-19 | Not applicable | Proof of concept only | Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL import. Unauthenticated visitors can submit arbitrary path (`pa`) and referrer (`r`) values to the public tracking endpoint in src/Resources/functions/collect.php, which stores those strings verbatim in the analytics tables. The admin export logic in src/Admin/Data_Export.php writes these stored values directly into SQL INSERT statements without escaping. A crafted path such as "),('999','x');DROP TABLE wp_users;-- breaks out of the value list. When an administrator later imports that export file, the import handler in src/Admin/Data_Import.php reads the uploaded SQL with file_get_contents, performs only a superficial header check, splits on semicolons, and executes each statement via $wpdb->query with no validation of table names or statement types. Additionally, any authenticated user with manage_koko_analytics can upload an arbitrary .sql file and have it executed in the same permissive way. Combined, attacker-controlled input flows from the tracking endpoint into exported SQL and through the import execution sink, or directly via malicious uploads, enabling arbitrary SQL execution. In a worst-case scenario, attackers can achieve arbitrary SQL execution on the WordPress database, allowing deletion of core tables (e.g., wp_users), insertion of backdoor administrator accounts, or other destructive/privilege-escalating actions. Version 2.1.3 patches the issue. |
| CVE-2026-1023 | High | 2026-01-16 | Not applicable | No public exploit | Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly exploit a specific functionality to query database contents. |
| CVE-2026-1022 | High | 2026-01-16 | Not applicable | No public exploit | Statistics Database System developed by Gotac has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files. |
| CVE-2025-47348 | High | 2026-01-07 | Not applicable | No public exploit | Memory corruption while processing identity credential operations in the trusted application. |
| CVE-2025-47323 | High | 2025-12-18 | Not applicable | No public exploit | Memory corruption while routing GPR packets between user and root when handling large data packet. |
| CVE-2025-47322 | High | 2025-12-18 | Not applicable | No public exploit | Memory corruption while handling IOCTL calls to set mode. |
| CVE-2025-47321 | High | 2025-12-18 | Not applicable | No public exploit | Memory corruption while copying packets received from unix clients. |
| CVE-2025-47320 | High | 2025-12-18 | Not applicable | No public exploit | Memory corruption while processing MFC channel configuration during music playback. |