Overview 28 matches · 6 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
28matches
6in Waratek scope21.4%
0protected0.0%
1exploited3.6%
1CISA KEV3.6%
2public PoC7.1%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
6
21.4%
Outside Waratek scope
1
3.6%
Not applicable
21
75.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
28
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
3.6%
Working exploit published
0
0.0%
Proof of concept only
8
28.6%
Forecast only
0
0.0%
No public exploit
19
67.9%
split by
peak 9 / year
20202
Not applicable2
Critical2
not blocked2
No public exploit2
20211
Not applicable1
High1
not blocked1
Proof of concept only1
20221
Not applicable1
Critical1
not blocked1
No public exploit1
20233
No exploit published2
Not applicable1
Critical1
High1
Medium1
not blocked3
Proof of concept only1
No public exploit2
20246
No exploit published4
Outside Waratek scope1
Not applicable1
Critical3
High1
Medium2
not blocked6
Proof of concept only5
No public exploit1
20259
Not applicable9
Critical3
High3
Medium3
not blocked9
Proof of concept only1
No public exploit8
20266
Not applicable6
Critical1
High2
Medium2
Low1
not blocked6
Exploited1
No public exploit5
2020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-127135 | Medium | 2026-11-12 | Not applicable | No public exploit | SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the notificationAddress preference to bypass the administrator-configured forwarding-domain constraint and redirect or discard incoming mail. |
| CVE-2026-108121 | Medium | 2026-10-19 | Not applicable | No public exploit | Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts. |
| CVE-2026-85475 | High | 2026-09-23 | Not applicable | No public exploit | A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane. |
| CVE-2026-68489 | High | 2026-09-14 | Not applicable | No public exploit | Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables. |
| CVE-2026-86218 | Critical | 2026-09-06 | Not applicable | Exploited | N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. |
| CVE-2025-57707 | Low | 2026-02-11 | Not applicable | No public exploit | An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to access restricted data / files. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5166 and later |
| CVE-2025-7825 | Medium | 2025-10-03 | Not applicable | No public exploit | The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. |
| CVE-2025-36595 | High | 2025-06-27 | Not applicable | No public exploit | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution. |
| CVE-2015-2079 | Critical | 2025-04-28 | Not applicable | Proof of concept only | Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open. |
| CVE-2025-30091 | Critical | 2025-03-25 | Not applicable | No public exploit | In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed. |
| CVE-2024-13268 | Medium | 2025-01-09 | Not applicable | No public exploit | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23. |
| CVE-2024-13267 | High | 2025-01-09 | Not applicable | No public exploit | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3. |
| CVE-2024-13265 | High | 2025-01-09 | Not applicable | No public exploit | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2. |
| CVE-2024-13264 | Critical | 2025-01-09 | Not applicable | No public exploit | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2. |
| CVE-2024-13263 | Medium | 2025-01-09 | Not applicable | No public exploit | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1. |
| CVE-2024-55877 | Critical | 2024-12-12 | No exploit published | Proof of concept only | XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been fixed in XWiki 15.10.11, 16.4.1 and 16.5.0. It is possible to manually apply the patch to the page `XWiki.XWikiSyntaxMacrosList` as a workaround. |
| CVE-2024-55662 | Critical | 2024-12-12 | No exploit published | Proof of concept only | XWiki Platform is a generic wiki platform. Starting in version 3.3-milestone-1 and prior to versions 15.10.9 and 16.3.0, on instances where `Extension Repository Application` is installed, any user can execute any code requiring `programming` rights on the server. This vulnerability has been fixed in XWiki 15.10.9 and 16.3.0. Since `Extension Repository Application` is not mandatory, it can be safely disabled on instances that do not use it as a workaround. It is also possible to manually apply the patches from commit 8659f17d500522bf33595e402391592a35a162e8 to the page `ExtensionCode.ExtensionSheet` and to the page `ExtensionCode.ExtensionAuthorsDisplayer`. |
| CVE-2024-43400 | Critical | 2024-08-19 | No exploit published | Proof of concept only | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible for a user without Script or Programming rights to craft a URL pointing to a page with arbitrary JavaScript. This requires social engineer to trick a user to follow the URL. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0. |
| CVE-2024-37900 | Medium | 2024-07-31 | No exploit published | Proof of concept only | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When uploading an attachment with a malicious filename, malicious JavaScript code could be executed. This requires a social engineering attack to get the victim into uploading a file with a malicious name. The malicious code is solely executed during the upload and affects only the user uploading the attachment. While this allows performing actions in the name of that user, it seems unlikely that a user wouldn't notice the malicious filename while uploading the attachment. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0. |
| CVE-2024-32487 | High | 2024-04-13 | Outside Waratek scope | No public exploit | less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN environment variable, but this is set by default in many common cases. |
| CVE-2024-0788 | Medium | 2024-01-29 | Not applicable | Proof of concept only | SUPERAntiSpyware Pro X v10.0.1260 is vulnerable to kernel-level API parameters manipulation and Denial of Service vulnerabilities by triggering the 0x9C402140 IOCTL code of the saskutil64.sys driver. |
| CVE-2023-39726 | Critical | 2023-10-26 | Not applicable | Proof of concept only | An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal. |
| CVE-2022-43938 | High | 2023-04-03 | No exploit published | No public exploit | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of Pentaho Reports (*.prpt) through the JVM script manager. |
| CVE-2022-3960 | Medium | 2023-04-03 | No exploit published | No public exploit | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. |
| CVE-2022-0895 | Critical | 2022-03-10 | Not applicable | No public exploit | Static Code Injection in GitHub repository microweber/microweber prior to 1.3. |
| CVE-2021-39115 | High | 2021-09-01 | Not applicable | Proof of concept only | Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0. |
| CVE-2020-6144 | Critical | 2020-09-01 | Not applicable | No public exploit | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2020-6143 | Critical | 2020-09-01 | Not applicable | No public exploit | A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability. |