Overview 8 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
12.5%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
7
87.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
8
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
8
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 2 / year
20181
Not applicable1
High1
not blocked1
Working exploit published1
20190
20201
Not applicable1
High1
not blocked1
Working exploit published1
20212
Mitigation candidate1
Not applicable1
Medium2
not blocked2
Working exploit published2
20221
Not applicable1
High1
not blocked1
Working exploit published1
20230
20242
Not applicable2
Medium2
not blocked2
Working exploit published2
20250
20261
Not applicable1
Critical1
not blocked1
Working exploit published1
201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-22778 | Critical | 2026-02-02 | Not applicable | Working exploit published | vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1. |
| CVE-2024-44762 | Medium | 2024-10-16 | Not applicable | Working exploit published | A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts. |
| CVE-2024-45440 | Medium | 2024-08-29 | Not applicable | Working exploit published | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. |
| CVE-2022-0660 | High | 2022-02-18 | Not applicable | Working exploit published | Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. |
| CVE-2021-22145 | Medium | 2021-07-21 | Mitigation candidate | Working exploit published | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details. |
| CVE-2021-31159 | Medium | 2021-06-16 | Not applicable | Working exploit published | Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732. |
| CVE-2020-15478 | High | 2020-07-01 | Not applicable | Working exploit published | The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors. |
| CVE-2018-17961 | High | 2018-10-15 | Not applicable | Working exploit published | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183. |