Overview 61 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
61matches
2in Waratek scope3.3%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
3.3%
Outside Waratek scope
0
0.0%
Not applicable
59
96.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
61
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
18
29.5%
Forecast only
0
0.0%
No public exploit
43
70.5%
split by
peak 21 / year
20191
Not applicable1
Medium1
not blocked1
No public exploit1
20203
Not applicable3
Medium3
not blocked3
No public exploit3
20215
Not applicable5
Medium5
not blocked5
Proof of concept only2
No public exploit3
20227
No exploit published1
Not applicable6
Medium7
not blocked7
Proof of concept only1
No public exploit6
20238
Not applicable8
Medium8
not blocked8
Proof of concept only4
No public exploit4
20247
Not applicable7
Medium7
not blocked7
Proof of concept only2
No public exploit5
20259
Not applicable9
Medium9
not blocked9
Proof of concept only4
No public exploit5
202621
No exploit published1
Not applicable20
Medium21
not blocked21
Proof of concept only5
No public exploit16
20192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-124576 | Medium | 2026-11-09 | Not applicable | Proof of concept only | A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component. |
| CVE-2026-124566 | Medium | 2026-11-09 | Not applicable | No public exploit | A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-123788 | Medium | 2026-11-06 | Not applicable | Proof of concept only | A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended. |
| CVE-2026-112028 | Medium | 2026-10-18 | Not applicable | Proof of concept only | A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument X-Requested-With causes business logic errors. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. |
| CVE-2026-109406 | Medium | 2026-10-13 | Not applicable | No public exploit | A weakness has been identified in macrozheng mall up to 1.0.3. This vulnerability affects the function OmsPortalOrderServiceImpl of the file /order/generateOrder of the component mall-portal. This manipulation of the argument coupon_amount/pay_amount causes business logic errors. The attack is possible to be carried out remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. |
| CVE-2026-108784 | Medium | 2026-10-12 | Not applicable | Proof of concept only | A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument total_amount results in business logic errors. The attack can be launched remotely. The exploit is now public and may be used. The patch is identified as dcaa93b3150352e5044708d7211b5bed0af4509f. A patch should be applied to remediate this issue. |
| CVE-2026-82982 | Medium | 2026-09-18 | Not applicable | No public exploit | The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed. |
| CVE-2026-79406 | Medium | 2026-08-25 | Not applicable | No public exploit | A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. |
| CVE-2026-13571 | Medium | 2026-06-29 | Not applicable | Proof of concept only | A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipulation of the argument item_price can lead to business logic errors. The attack may be performed from remote. The exploit has been published and may be used. |
| CVE-2026-41973 | Medium | 2026-06-09 | Not applicable | No public exploit | Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-8738 | Medium | 2026-05-17 | Not applicable | No public exploit | A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java of the component Trade Payment Flow. The manipulation leads to business logic errors. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-41971 | Medium | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-41968 | Medium | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-41967 | Medium | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-41966 | Medium | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2026-41965 | Medium | 2026-05-15 | Not applicable | No public exploit | Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-41961 | Medium | 2026-05-15 | Not applicable | No public exploit | Permission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2026-1274 | Medium | 2026-04-23 | Not applicable | No public exploit | IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control panel. |
| CVE-2026-4547 | Medium | 2026-03-22 | Not applicable | No public exploit | A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the file actions/generate-user-stripe.ts of the component Checkout Handler. The manipulation of the argument priceId leads to business logic errors. The attack may be initiated remotely. |
| CVE-2026-28550 | Medium | 2026-03-05 | Not applicable | No public exploit | Race condition vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-14559 | Medium | 2026-01-21 | No exploit published | No public exploit | A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow. |
| CVE-2025-6601 | Medium | 2025-10-27 | Not applicable | No public exploit | GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow. |
| CVE-2025-58289 | Medium | 2025-10-11 | Not applicable | No public exploit | Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability. |
| CVE-2025-10868 | Medium | 2025-09-26 | Not applicable | No public exploit | An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string conversion methods exhibit performance degradation with large inputs. |
| CVE-2025-4037 | Medium | 2025-04-28 | Not applicable | Proof of concept only | A vulnerability was found in code-projects ATM Banking 1.0. It has been classified as critical. Affected is the function moneyDeposit/moneyWithdraw. The manipulation leads to business logic errors. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. |
| CVE-2024-6577 | Medium | 2025-03-20 | Not applicable | Proof of concept only | In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not properly secured or claimed by the appropriate entity. The issue may result in data breaches, exposure of proprietary information, or unauthorized modifications to stored data. |
| CVE-2025-2323 | Medium | 2025-03-15 | Not applicable | Proof of concept only | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been declared as problematic. This vulnerability affects the function updateQuestionCou of the file /api/mjkj-chat/chat/mng/update/questionCou of the component Number of Question Handler. The manipulation leads to enforcement of behavioral workflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-2321 | Medium | 2025-03-15 | Not applicable | Proof of concept only | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this issue is some unknown functionality of the file /api/mjkj-chat/cgform-api/addData/. The manipulation of the argument chatUserID leads to business logic errors. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2024-58046 | Medium | 2025-03-04 | Not applicable | No public exploit | Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2025-24425 | Medium | 2025-02-11 | Not applicable | No public exploit | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Business Logic Error vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to circumvent intended security mechanisms by manipulating the logic of the application's operations causing limited data modification. Exploitation of this issue does not require user interaction. |
| CVE-2024-1682 | Medium | 2024-11-14 | Not applicable | Proof of concept only | An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of trustworthiness, and potential further attacks if the bucket is used to host malicious content or as a pivot point for further attacks. |
| CVE-2018-25104 | Medium | 2024-10-17 | Not applicable | No public exploit | A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the function postProcess of the file modules/coingate/controllers/front/callback.php of the component Payment Handler. The manipulation leads to business logic errors. The attack may be launched remotely. Upgrading to version 1.2.8 is able to address this issue. The patch is identified as 0a3097db0aec7c5d66686c142c6abaa1e126ca16. It is recommended to upgrade the affected component. |
| CVE-2024-42034 | Medium | 2024-08-08 | Not applicable | No public exploit | LaunchAnywhere vulnerability in the account module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
| CVE-2023-7271 | Medium | 2024-07-25 | Not applicable | No public exploit | Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability. |
| CVE-2024-4046 | Medium | 2024-05-14 | Not applicable | No public exploit | Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability. |
| CVE-2024-32999 | Medium | 2024-05-14 | Not applicable | No public exploit | Cracking vulnerability in the OS security module Impact: Successful exploitation of this vulnerability will affect availability. |
| CVE-2024-2151 | Medium | 2024-03-04 | Not applicable | Proof of concept only | A vulnerability classified as problematic was found in SourceCodester Online Mobile Management Store 1.0. Affected by this vulnerability is an unknown functionality of the component Product Price Handler. The manipulation of the argument quantity with the input -1 leads to business logic errors. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255583. |
| CVE-2023-6832 | Medium | 2023-12-15 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. |
| CVE-2023-6566 | Medium | 2023-12-07 | Not applicable | No public exploit | Business Logic Errors in GitHub repository microweber/microweber prior to 2.0. |
| CVE-2023-29294 | Medium | 2023-06-15 | Not applicable | No public exploit | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Business Logic Errors vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass a minor functionality. Exploitation of this issue does not require user interaction. |
| CVE-2023-3229 | Medium | 2023-06-14 | Not applicable | No public exploit | Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. |
| CVE-2023-3228 | Medium | 2023-06-14 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0. |
| CVE-2023-1887 | Medium | 2023-04-05 | Not applicable | No public exploit | Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
| CVE-2023-1542 | Medium | 2023-03-21 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6. |
| CVE-2023-0565 | Medium | 2023-01-29 | Not applicable | Proof of concept only | Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10. |
| CVE-2022-32208 | Medium | 2022-07-07 | Not applicable | Proof of concept only | When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client. |
| CVE-2022-1848 | Medium | 2022-05-24 | No exploit published | No public exploit | Business Logic Errors in GitHub repository erudika/para prior to 1.45.11. |
| CVE-2022-0514 | Medium | 2022-03-21 | Not applicable | No public exploit | Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5. |
| CVE-2022-0746 | Medium | 2022-02-25 | Not applicable | No public exploit | Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0. |
| CVE-2022-0688 | Medium | 2022-02-20 | Not applicable | No public exploit | Business Logic Errors in Packagist microweber/microweber prior to 1.2.11. |
| CVE-2022-0689 | Medium | 2022-02-19 | Not applicable | No public exploit | Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11. |
| CVE-2021-4146 | Medium | 2022-01-18 | Not applicable | No public exploit | Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6. |
| CVE-2021-4117 | Medium | 2021-12-15 | Not applicable | No public exploit | yetiforcecrm is vulnerable to Business Logic Errors |
| CVE-2021-4111 | Medium | 2021-12-15 | Not applicable | No public exploit | yetiforcecrm is vulnerable to Business Logic Errors |
| CVE-2021-36012 | Medium | 2021-09-01 | Not applicable | No public exploit | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item. |
| CVE-2021-22922 | Medium | 2021-08-05 | Not applicable | Proof of concept only | When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk. |
| CVE-2021-22897 | Medium | 2021-06-11 | Not applicable | Proof of concept only | curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly. |
| CVE-2020-8228 | Medium | 2020-10-05 | Not applicable | No public exploit | A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times. |
| CVE-2020-8181 | Medium | 2020-07-10 | Not applicable | No public exploit | A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars. |
| CVE-2019-15608 | Medium | 2020-03-15 | Not applicable | No public exploit | The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. |
| CVE-2019-3789 | Medium | 2019-04-24 | Not applicable | No public exploit | Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route. |