WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-913✕
Overview 6 matches · 1 in Waratek scope · 0 protected · 1 CISA KEV · 5 public PoC · 3 EPSS ≥ 0.5
6matches 1in Waratek scope16.7% 0protected0.0% 1CISA KEV16.7% 5public PoC83.3% 3EPSS ≥ 0.550.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 16.7% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 5 83.3% Withdrawn CVE 0 0.0%
Critical 4 66.7% High 2 33.3% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 6 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 6 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Not applicable: 5Mitigation candidate: 1 High: 2Critical: 4 not blocked: 6 Exploited: 6
Q1 211 Not applicable1 Critical1 not blocked1 Exploited1 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 220 Q4 220 Q1 230 Q2 230 Q3 230 Q4 231 Not applicable1 Critical1 not blocked1 Exploited1 Q1 242 Mitigation candidate1 Not applicable1 High2 not blocked2 Exploited2 Q2 240 Q3 240 Q4 240 Q1 250 Q2 250 Q3 250 Q4 251 Not applicable1 Critical1 not blocked1 Exploited1 Q1 260 Q2 261 Not applicable1 Critical1 not blocked1 Exploited1
Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25Q4 25Q2 26
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-53753 Critical 2026-06-23 Not applicable Exploited Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7.
CVE-2025-68613 Critical 2025-12-19 Not applicable Exploited n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution (RCE) vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficiently isolated from the underlying runtime. An authenticated attacker could abuse this behavior to execute arbitrary code with the privileges of the n8n process. Successful exploitation may lead to full compromise of the affected instance, including unauthorized access to sensitive data, modification of workflows, and execution of system-level operations. This issue has been fixed in versions 1.120.4, 1.121.1, and 1.122.0. Users are strongly advised to upgrade to a patched version, which introduces additional safeguards to restrict expression evaluation. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Limit workflow creation and editing permissions to fully trusted users only; and/or deploy n8n in a hardened environment with restricted operating system privileges and network access to reduce the impact of potential exploitation. These workarounds do not fully eliminate the risk and should only be used as short-term measures.
CVE-2023-50386 High 2024-02-09 Mitigation candidate Exploited Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected versions, Solr ConfigSets accepted Java jar and class files to be uploaded through the ConfigSets API. When backing up Solr Collections, these configSet files would be saved to disk when using the LocalFileSystemRepository (the default for backups). If the backup was saved to a directory that Solr uses in its ClassPath/ClassLoaders, then the jar and class files would be available to use with any ConfigSet, trusted or untrusted. When Solr is run in a secure way (Authorization enabled), as is strongly suggested, this vulnerability is limited to extending the Backup permissions with the ability to add libraries. Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. In these versions, the following protections have been added: * Users are no longer able to upload files to a configSet that could be executed via a Java ClassLoader. * The Backup API restricts saving backups to directories that are used in the ClassLoader.
CVE-2023-6184 High 2024-01-18 Not applicable Exploited Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting
CVE-2023-43177 Critical 2023-11-18 Not applicable Exploited CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
CVE-2020-15568 Critical 2021-01-30 Not applicable Exploited TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php, in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.