WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕CWE CWE-749✕Has a public PoC✕
Overview 7 matches · 1 in Waratek scope · 1 protected · 3 exploited · 3 CISA KEV · 2 EPSS ≥ 0.5
7matches 1in Waratek scope14.3% 1protected14.3% 3exploited42.9% 3CISA KEV42.9% 2EPSS ≥ 0.528.6%
Protected by Waratek 1 14.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 14.3% Not applicable 5 71.4% Withdrawn CVE 0 0.0%
Critical 1 14.3% High 4 57.1% Medium 2 28.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 14.3% partly blocked 0 0.0% not blocked 6 85.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 42.9% Working exploit published 2 28.6% Proof of concept only 2 28.6% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 5Outside Waratek scope: 1Protected by Waratek: 1 Medium: 2High: 4Critical: 1 not blocked: 6blocked by ARMR today: 1 Proof of concept only: 2Working exploit published: 2Exploited: 3
20102 Protected by Waratek1 Outside Waratek scope1 High1 Medium1 blocked by ARMR today1 not blocked1 Exploited2 20110 20120 20130 20140 20150 20160 20170 20180 20190 20201 Not applicable1 High1 not blocked1 Proof of concept only1 20210 20220 20230 20241 Not applicable1 High1 not blocked1 Proof of concept only1 20250 20263 Not applicable3 Critical1 High1 Medium1 not blocked3 Exploited1 Working exploit published2
201020122014201620182020202220242026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-116779 Critical 2026-11-05 Not applicable Exploited FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.
CVE-2026-14620 Medium 2026-07-03 Not applicable Working exploit published webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.
CVE-2026-22812 High 2026-01-12 Not applicable Working exploit published OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216.
CVE-2023-27363 High 2024-05-03 Not applicable Proof of concept only Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportXFAData method. The application exposes a JavaScript interface that allows writing arbitrary files. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19697.
CVE-2020-12928 High 2020-10-13 Not applicable Proof of concept only A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT authority system.
CVE-2010-1428 High 2010-04-28 Outside Waratek scope Exploited The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
CVE-2010-0738 Medium 2010-04-28 Protected by Waratek Exploited The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.