WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Secure Backup / Oracle Secure Backup (PHP)✕
Overview 5 matches · 0 in Waratek scope · 0 protected · 2 exploited · 2 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
5matches 0in Waratek scope0.0% 0protected0.0% 2exploited40.0% 2CISA KEV40.0% 2public PoC40.0% 2EPSS ≥ 0.540.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 5 100.0% Withdrawn CVE 0 0.0%
Critical 2 40.0% High 3 60.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 40.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 60.0%
split by peak 3 / quarter
Not applicable: 5 High: 3Critical: 2 not blocked: 5 No public exploit: 3Exploited: 2
Q1 233 Not applicable3 High3 not blocked3 No public exploit3 Q2 230 Q3 230 Q4 230 Q1 240 Q2 240 Q3 240 Q4 240 Q1 250 Q2 250 Q3 250 Q4 250 Q1 260 Q2 260 Q3 260 Q4 262 Not applicable2 Critical2 not blocked2 Exploited2
Q2 23Q4 23Q2 24Q4 24Q2 25Q4 25Q2 26Q4 26
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-109619 Critical 2026-10-21 Not applicable Exploited PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
CVE-2026-109618 Critical 2026-10-21 Not applicable Exploited PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
CVE-2023-0567 High 2023-03-01 Not applicable No public exploit In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.
CVE-2023-0662 High 2023-02-16 Not applicable No public exploit In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.
CVE-2023-0568 High 2023-02-16 Not applicable No public exploit In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.