WaratekVRT Sign in

High CWE-326 CVEs

11 CVEs, 1 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-326✕
Overview 11 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
11matches 1protected9.1% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 9.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 10 90.9%
Critical 0 0.0% High 11 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 9.1% partly blocked 0 0.0% not blocked 10 90.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 9.1% Forecast only 0 0.0% No public exploit 10 90.9%
split by peak 4 / year
No exploit published: 10Protected by Waratek: 1 High: 11 not blocked: 10blocked by ARMR today: 1 No public exploit: 10Proof of concept only: 1
20171 No exploit published1 High1 not blocked1 No public exploit1 20181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20191 No exploit published1 High1 not blocked1 No public exploit1 20200 20210 20224 No exploit published4 High4 not blocked4 Proof of concept only1 No public exploit3 20230 20242 No exploit published2 High2 not blocked2 No public exploit2 20250 20262 No exploit published2 High2 not blocked2 No public exploit2
2017201820192020202120222023202420252026
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-59651 High 2026-08-03 No exploit published No public exploit In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
CVE-2025-68703 High 2026-01-13 No exploit published No public exploit Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2.
CVE-2024-39928 High 2024-09-25 No exploit published No public exploit In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are recommended to upgrade to version 1.6.0, which fixes this issue.
CVE-2024-36823 High 2024-06-06 No exploit published No public exploit The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.
CVE-2022-45379 High 2022-11-15 No exploit published No public exploit Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks.
CVE-2022-29249 High 2022-05-24 No exploit published No public exploit JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of locked text by unauthorized actors. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. The vulnerability has been patched in release 1.7. Currently, there is no way to fix the issue without upgrading.
CVE-2021-45458 High 2022-01-06 No exploit published No public exploit Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin's configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
CVE-2022-21653 High 2022-01-05 No exploit published Proof of concept only Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack which may result in a denial of service. Most applications do not implement these traits directly, but inherit from a library. `jawn-parser-1.3.1` fixes this issue and users are advised to upgrade. For users unable to upgrade override `objectContext()` to use a collision-safe collection.
CVE-2019-17598 High 2019-11-05 No exploit published No public exploit An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.
CVE-2016-1000352 High 2018-06-04 Protected by Waratek No public exploit In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
CVE-2014-7808 High 2017-09-15 No exploit published No public exploit Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.