WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-35✕
Overview 9 matches · 0 in Waratek scope · 0 protected · 1 CISA KEV · 5 public PoC · 2 EPSS ≥ 0.5
9matches 0in Waratek scope0.0% 0protected0.0% 1CISA KEV11.1% 5public PoC55.6% 2EPSS ≥ 0.522.2%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 9 100.0% Withdrawn CVE 0 0.0%
Critical 1 11.1% High 7 77.8% Medium 1 11.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 9 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 9 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Not applicable: 9 Medium: 1High: 7Critical: 1 not blocked: 9 Exploited: 9
Q1 241 Not applicable1 Critical1 not blocked1 Exploited1 Q2 240 Q3 242 Not applicable2 High2 not blocked2 Exploited2 Q4 242 Not applicable2 High1 Medium1 not blocked2 Exploited2 Q1 250 Q2 252 Not applicable2 High2 not blocked2 Exploited2 Q3 251 Not applicable1 High1 not blocked1 Exploited1 Q4 251 Not applicable1 High1 not blocked1 Exploited1
Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-27222 High 2025-10-27 Not applicable Exploited TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. However, the application doesn't properly sanitize the input to this endpoint, ultimately allowing path traversal sequences to be included. This can be used to read any local server file that is accessible by the TRUfusion user and can also be used to leak cleartext passwords of TRUfusion Enterprise itself.
CVE-2025-8088 High 2025-08-08 Not applicable Exploited A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček from ESET.
CVE-2025-47176 High 2025-06-10 Not applicable Exploited '.../...//' in Microsoft Office Outlook allows an authorized attacker to execute code locally.
CVE-2025-39475 High 2025-06-09 Not applicable Exploited Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <= 6.0.3.
CVE-2024-10857 Medium 2024-11-26 Not applicable Exploited The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVE-2020-26073 High 2024-11-18 Not applicable Exploited A vulnerability in the application data endpoints of Cisco&nbsp;SD-WAN vManage Software could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to application programmatic interfaces (APIs). An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and gain access to sensitive information including credentials or user tokens.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVE-2024-38706 High 2024-07-12 Not applicable Exploited Path Traversal: '.../...//' vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.5.7.
CVE-2024-36991 High 2024-07-01 Not applicable Exploited In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. This vulnerability should only affect Splunk Enterprise on Windows.
CVE-2024-2863 Critical 2024-03-25 Not applicable Exploited This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.