WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-321✕
Overview 10 matches · 1 in Waratek scope · 0 protected · 2 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
10matches 1in Waratek scope10.0% 0protected0.0% 2CISA KEV20.0% 3public PoC30.0% 2EPSS ≥ 0.520.0%
Protected by Waratek 1 10.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 9 90.0% Withdrawn CVE 0 0.0%
Critical 9 90.0% High 0 0.0% Medium 1 10.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 1 10.0% not blocked 9 90.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 10 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / year
Not applicable: 9Protected by Waratek: 1 Medium: 1Critical: 9 not blocked: 9partly blocked: 1 Exploited: 10
20161 Protected by Waratek1 Critical1 partly blocked1 Exploited1 20170 20180 20191 Not applicable1 Critical1 not blocked1 Exploited1 20200 20210 20220 20230 20243 Not applicable3 Critical2 Medium1 not blocked3 Exploited3 20251 Not applicable1 Critical1 not blocked1 Exploited1 20264 Not applicable4 Critical4 not blocked4 Exploited4
20162017201820192020202120222023202420252026
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-89026 Critical 2026-09-15 Not applicable Exploited The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09.
CVE-2026-74233 Critical 2026-08-27 Not applicable Exploited Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
CVE-2026-56271 Critical 2026-07-12 Not applicable Exploited Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_AUDIENCE, JWT_ISSUER) are not set, the application silently falls back to these publicly known defaults, allowing an attacker to forge valid JWTs and impersonate any user, including administrators, resulting in authentication bypass.
CVE-2026-5426 Critical 2026-04-16 Not applicable Exploited Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserialization attacks
CVE-2025-30406 Critical 2025-04-03 Not applicable Exploited Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\web.config.
CVE-2019-19754 Medium 2024-04-30 Not applicable Exploited HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-09-26, the vendor indicated that they would consider fixing this.
CVE-2019-19753 Critical 2024-04-30 Not applicable Exploited SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: the vendor indicated that they have no plans to fix this, and discourage deployment using public IPv4.
CVE-2019-19752 Critical 2024-04-30 Not applicable Exploited nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plans to fix this in the next image build.
CVE-2019-19750 Critical 2019-12-12 Not applicable Exploited minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.
CVE-2016-4437 Critical 2016-06-07 Protected by Waratek Exploited Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.