Overview 14 matches · 0 in Waratek scope · 0 protected · 3 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
14
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
14
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
3
21.4%
Working exploit published
10
71.4%
Proof of concept only
1
7.1%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 4 / quarter
Q2 242
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
Q3 242
Not applicable2
High2
not blocked2
Exploited1
Working exploit published1
Q4 240
Q1 252
Not applicable2
Medium2
not blocked2
Working exploit published1
Proof of concept only1
Q2 250
Q3 251
Not applicable1
Medium1
not blocked1
Working exploit published1
Q4 254
Not applicable4
High2
Medium2
not blocked4
Working exploit published4
Q1 262
Not applicable2
High2
not blocked2
Exploited1
Working exploit published1
Q2 260
Q3 261
Not applicable1
High1
not blocked1
Exploited1
Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25Q1 26Q2 26Q3 26
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-47717 | High | 2026-08-12 | Not applicable | Exploited | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue. |
| CVE-2026-27934 | High | 2026-03-19 | Not applicable | Working exploit published | Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available. |
| CVE-2026-24477 | High | 2026-01-27 | Not applicable | Exploited | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of QdrantApiKey allows an unauthenticated attacker full read/write access to the Qdrant vector database instance used by AnythingLLM. Since Qdrant often stores the core knowledge base for RAG in AnythingLLM, this can lead to complete compromise of the semantic search / retrieval functionality and indirect leakage of confidential uploaded documents. Version 1.10.0 patches the issue. |
| CVE-2025-62126 | Medium | 2025-12-31 | Not applicable | Working exploit published | Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Retrieve Embedded Sensitive Data.This issue affects Varnish/Nginx Proxy Caching: from n/a through <= 1.8.3. |
| CVE-2025-59136 | Medium | 2025-12-31 | Not applicable | Working exploit published | Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Data.This issue affects Gerencianet Oficial: from n/a through <= 3.1.3. |
| CVE-2025-62039 | High | 2025-11-06 | Not applicable | Working exploit published | Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Retrieve Embedded Sensitive Data.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.6.6. |
| CVE-2025-60188 | High | 2025-11-06 | Not applicable | Working exploit published | Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.1. |
| CVE-2025-58226 | Medium | 2025-09-22 | Not applicable | Working exploit published | Insertion of Sensitive Information Into Sent Data vulnerability in iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery interactive-3d-flipbook-powered-physics-engine allows Retrieve Embedded Sensitive Data.This issue affects 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery: from n/a through <= 1.16.16. |
| CVE-2025-26318 | Medium | 2025-03-04 | Not applicable | Proof of concept only | hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application. |
| CVE-2025-24582 | Medium | 2025-01-24 | Not applicable | Working exploit published | Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5. |
| CVE-2024-6586 | High | 2024-08-30 | Not applicable | Working exploit published | Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to /api/v1/dashboards//export. The forged request contains the value of the exporting user’s session token. A threat actor could obtain the session token of any user who exports the dashboard. The obtained session token can be used to perform actions as the victim on the application, resulting in session takeover. |
| CVE-2024-43283 | High | 2024-08-26 | Not applicable | Exploited | Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 23.1.2. |
| CVE-2024-37881 | Medium | 2024-06-19 | Not applicable | Working exploit published | SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard WP Plugin versions prior to 1.7.7 missed to implement a measure to avoid redirection from wp-register.php. As a result, the customized path to the login page may be exposed. |
| CVE-2024-32825 | High | 2024-04-24 | Not applicable | Working exploit published | Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through <= 3.1.3. |