WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-201✕
Overview 8 matches · 0 in Waratek scope · 0 protected · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
8matches 0in Waratek scope0.0% 0protected0.0% 0CISA KEV0.0% 3public PoC37.5% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 8 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 7 87.5% Medium 1 12.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 8 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Not applicable: 8 Medium: 1High: 7 not blocked: 8 Exploited: 8
Q1 241 Not applicable1 High1 not blocked1 Exploited1 Q2 240 Q3 241 Not applicable1 High1 not blocked1 Exploited1 Q4 240 Q1 250 Q2 251 Not applicable1 High1 not blocked1 Exploited1 Q3 250 Q4 251 Not applicable1 Medium1 not blocked1 Exploited1 Q1 261 Not applicable1 High1 not blocked1 Exploited1 Q2 261 Not applicable1 High1 not blocked1 Exploited1 Q3 262 Not applicable2 High2 not blocked2 Exploited2
Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25Q1 26Q2 26Q3 26
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-66443 High 2026-08-13 Not applicable Exploited Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.
CVE-2026-47717 High 2026-08-12 Not applicable Exploited FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.
CVE-2026-4035 High 2026-06-03 Not applicable Exploited A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream `api_base`. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without `basic-auth`. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0.
CVE-2026-24477 High 2026-01-27 Not applicable Exploited AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of QdrantApiKey allows an unauthenticated attacker full read/write access to the Qdrant vector database instance used by AnythingLLM. Since Qdrant often stores the core knowledge base for RAG in AnythingLLM, this can lead to complete compromise of the semantic search / retrieval functionality and indirect leakage of confidential uploaded documents. Version 1.10.0 patches the issue.
CVE-2025-68040 Medium 2025-12-30 Not applicable Exploited Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through 3.0.1.
CVE-2025-47541 High 2025-05-23 Not applicable Exploited Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Team Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through 1.17.7.
CVE-2024-43283 High 2024-08-26 Not applicable Exploited Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 23.1.2.
CVE-2024-23506 High 2024-01-27 Not applicable Exploited Insertion of Sensitive Information Into Sent Data vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.