WaratekVRT Sign in

Exploited Medium CWE-918 CVEs

2 CVEs

Reset
More filters (1)
Columns
CWE CWE-918✕
Overview 2 matches · 0 protected · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
2matches 0protected0.0% 0CISA KEV0.0% 1public PoC50.0% 1EPSS ≥ 0.550.0%
Protected by Waratek 0 0.0% Rule in development 1 50.0% Mitigation candidate 1 50.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 2 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / quarter
Mitigation candidate: 1Rule in development: 1 Medium: 2 not blocked: 2 Exploited: 2
Q4 201 Mitigation candidate1 Medium1 not blocked1 Exploited1 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 220 Q4 220 Q1 230 Q2 230 Q3 230 Q4 230 Q1 240 Q2 240 Q3 240 Q4 240 Q1 250 Q2 250 Q3 251 Rule in development1 Medium1 not blocked1 Exploited1
Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-4581 Medium 2025-08-09 Rule in development Exploited Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.
CVE-2020-10770 Medium 2020-12-15 Mitigation candidate Exploited A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.