WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-96✕
Overview 21 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
21matches 0in Waratek scope0.0% 0protected0.0% 1exploited4.8% 1CISA KEV4.8% 2public PoC9.5% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 21 100.0% Withdrawn CVE 0 0.0%
Critical 8 38.1% High 6 28.6% Medium 6 28.6% Low 1 4.8% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 21 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 4.8% Working exploit published 0 0.0% Proof of concept only 4 19.0% Forecast only 0 0.0% No public exploit 16 76.2%
split by peak 9 / year
Not applicable: 21 Low: 1Medium: 6High: 6Critical: 8 not blocked: 21 No public exploit: 16Proof of concept only: 4Exploited: 1
20202 Not applicable2 Critical2 not blocked2 No public exploit2 20211 Not applicable1 High1 not blocked1 Proof of concept only1 20221 Not applicable1 Critical1 not blocked1 No public exploit1 20231 Not applicable1 Critical1 not blocked1 Proof of concept only1 20241 Not applicable1 Medium1 not blocked1 Proof of concept only1 20259 Not applicable9 Critical3 High3 Medium3 not blocked9 Proof of concept only1 No public exploit8 20266 Not applicable6 Critical1 High2 Medium2 Low1 not blocked6 Exploited1 No public exploit5
2020202120222023202420252026
21 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-127135 Medium 2026-11-12 Not applicable No public exploit SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the notificationAddress preference to bypass the administrator-configured forwarding-domain constraint and redirect or discard incoming mail.
CVE-2026-108121 Medium 2026-10-19 Not applicable No public exploit Brian Mariani from DigitalCanion SA has discovered a  vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from starting after a server reboot, resulting in a denial-of-service (DoS) condition affecting the web server and its hosted virtual hosts.
CVE-2026-85475 High 2026-09-23 Not applicable No public exploit A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config file without neutralizing RainerScript syntax. A privileged (superuser) user can inject rsyslog directives, including an omprog action, causing arbitrary command execution inside the control-plane rsyslog component. This allows disclosure of the controller SECRET_KEY and database credentials, decryption of all stored credentials, and full compromise of the control plane.
CVE-2026-68489 High 2026-09-14 Not applicable No public exploit Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
CVE-2026-86218 Critical 2026-09-06 Not applicable Exploited N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.
CVE-2025-57707 Low 2026-02-11 Not applicable No public exploit An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to access restricted data / files. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5166 and later
CVE-2025-7825 Medium 2025-10-03 Not applicable No public exploit The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
CVE-2025-36595 High 2025-06-27 Not applicable No public exploit Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
CVE-2015-2079 Critical 2025-04-28 Not applicable Proof of concept only Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.
CVE-2025-30091 Critical 2025-03-25 Not applicable No public exploit In Tiny MoxieManager PHP before 4.0.0, remote code execution can occur in the installer command. This vulnerability allows unauthenticated attackers to inject and execute arbitrary code. Attacker-controlled data to InstallCommand can be inserted into config.php, and InstallCommand is available after an installation has completed.
CVE-2024-13268 Medium 2025-01-09 Not applicable No public exploit Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.
CVE-2024-13267 High 2025-01-09 Not applicable No public exploit Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.
CVE-2024-13265 High 2025-01-09 Not applicable No public exploit Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.
CVE-2024-13264 Critical 2025-01-09 Not applicable No public exploit Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.
CVE-2024-13263 Medium 2025-01-09 Not applicable No public exploit Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.
CVE-2024-0788 Medium 2024-01-29 Not applicable Proof of concept only SUPERAntiSpyware Pro X v10.0.1260 is vulnerable to kernel-level API parameters manipulation and Denial of Service vulnerabilities by triggering the 0x9C402140 IOCTL code of the saskutil64.sys driver.
CVE-2023-39726 Critical 2023-10-26 Not applicable Proof of concept only An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.
CVE-2022-0895 Critical 2022-03-10 Not applicable No public exploit Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
CVE-2021-39115 High 2021-09-01 Not applicable Proof of concept only Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to execute arbitrary Java code or run arbitrary system commands via a Server_Side Template Injection vulnerability in the Email Template feature. The affected versions are before version 4.13.9, and from version 4.14.0 before 4.18.0.
CVE-2020-6144 Critical 2020-09-01 Not applicable No public exploit A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2020-6143 Critical 2020-09-01 Not applicable No public exploit A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.