WaratekVRT Sign in

Medium CWE-776 CVEs

5 CVEs, 5 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-776✕
Overview 5 matches · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
5matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 5 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 5 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 100.0%
split by peak 2 / year
Protected by Waratek: 5 Medium: 5 blocked by ARMR today: 5 No public exploit: 5
20141 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20150 20160 20171 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20180 20190 20201 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20210 20220 20230 20240 20250 20262 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2
2014201620182020202220242026
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-111252 Medium 2026-10-15 Protected by Waratek No public exploit A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server memory. An authenticated user with provisioning access can supply such a document through a requisition or foreign-source import, which includes a remote requisition URL that the server fetches and parses. Both deeply nested entities and a single large entity referenced many times cause the memory exhaustion. The fix caps the number of entity expansions for all XML parsing and rejects any DOCTYPE in requisition and foreign-source XML. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
CVE-2026-12993 Medium 2026-06-26 Protected by Waratek No public exploit A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.
CVE-2020-2172 Medium 2020-04-07 Protected by Waratek No public exploit Jenkins Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2017-5644 Medium 2017-03-24 Protected by Waratek No public exploit Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
CVE-2014-1868 Medium 2014-10-06 Protected by Waratek No public exploit Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.