WaratekVRT Sign in

Critical CWE-358 CVEs

3 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-358✕
Overview 3 matches · 2 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
3matches 2protected66.7% 0exploited0.0% 0CISA KEV0.0% 1public PoC33.3% 2EPSS ≥ 0.566.7%
Protected by Waratek 2 66.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 33.3%
Critical 3 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 66.7% partly blocked 0 0.0% not blocked 1 33.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 33.3% Forecast only 1 33.3% No public exploit 1 33.3%
split by peak 2 / year
No exploit published: 1Protected by Waratek: 2 Critical: 3 not blocked: 1blocked by ARMR today: 2 No public exploit: 1Forecast only: 1Proof of concept only: 1
20182 Protected by Waratek2 Critical2 blocked by ARMR today2 Proof of concept only1 Forecast only1 20190 20200 20210 20220 20230 20240 20250 20261 No exploit published1 Critical1 not blocked1 No public exploit1
201820192020202120222023202420252026
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-50628 Critical 2026-06-12 No exploit published No public exploit A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.
CVE-2018-1275 Critical 2018-04-11 Protected by Waratek Forecast only Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
CVE-2018-1270 Critical 2018-04-06 Protected by Waratek Proof of concept only Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.