WaratekVRT Sign in

Advisor CVEs with no public exploit

15 CVEs, 3 protected by Waratek

Reset
More filters (1)
Columns
Product advisor✕
Overview 15 matches · 3 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
15matches 3protected20.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 3 20.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 12 80.0%
Critical 0 0.0% High 9 60.0% Medium 6 40.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 20.0% partly blocked 0 0.0% not blocked 12 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 15 100.0%
split by peak 6 / year
No exploit published: 12Protected by Waratek: 3 Medium: 6High: 9 not blocked: 12blocked by ARMR today: 3 No public exploit: 15
20171 No exploit published1 High1 not blocked1 No public exploit1 20181 No exploit published1 Medium1 not blocked1 No public exploit1 20190 20206 Protected by Waratek2 No exploit published4 High2 Medium4 blocked by ARMR today2 not blocked4 No public exploit6 20210 20220 20233 Protected by Waratek1 No exploit published2 High3 blocked by ARMR today1 not blocked2 No public exploit3 20240 20251 No exploit published1 High1 not blocked1 No public exploit1 20263 No exploit published3 High2 Medium1 not blocked3 No public exploit3
2017201820192020202120222023202420252026
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-60499 High 2026-07-21 No exploit published No public exploit Vulnerability in the JD Edwards EnterpriseOne Solution Advisor product of Oracle JD Edwards (component: Solution Advisor). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Solution Advisor. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Solution Advisor. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-41712 High 2026-05-12 No exploit published No public exploit Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
CVE-2026-40966 Medium 2026-04-28 No exploit published No public exploit In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.
CVE-2025-47885 High 2025-05-14 No exploit published No public exploit Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses.
CVE-2023-3223 High 2023-09-27 No exploit published No public exploit A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
CVE-2023-4853 High 2023-09-20 No exploit published No public exploit A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.
CVE-2022-1415 High 2023-09-11 Protected by Waratek No public exploit A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
CVE-2020-2258 Medium 2020-09-16 No exploit published No public exploit Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view that HTTP endpoint.
CVE-2019-14900 Medium 2020-07-06 Protected by Waratek No public exploit A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
CVE-2011-2487 Medium 2020-03-11 Protected by Waratek No public exploit The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
CVE-2020-7238 High 2020-01-27 No exploit published No public exploit Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
CVE-2020-2094 Medium 2020-01-15 No exploit published No public exploit A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient.
CVE-2020-2093 High 2020-01-15 No exploit published No public exploit A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers to send an email with fixed content to an attacker-specified recipient.
CVE-2018-1288 Medium 2018-07-26 No exploit published No public exploit In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
CVE-2016-4970 High 2017-04-13 No exploit published No public exploit handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).