WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕EPSS ≥ 0.5✕Vendor lfprojects✕
Overview 5 matches · 0 in Waratek scope · 0 protected · 4 exploited · 0 CISA KEV
5matches 0in Waratek scope0.0% 0protected0.0% 4exploited80.0% 0CISA KEV0.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 5 100.0% Withdrawn CVE 0 0.0%
Critical 4 80.0% High 1 20.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 80.0% Working exploit published 1 20.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Not applicable: 5 High: 1Critical: 4 not blocked: 5 Working exploit published: 1Exploited: 4
Q1 231 Not applicable1 Critical1 not blocked1 Exploited1 Q2 230 Q3 231 Not applicable1 Critical1 not blocked1 Working exploit published1 Q4 231 Not applicable1 High1 not blocked1 Exploited1 Q1 240 Q2 240 Q3 240 Q4 240 Q1 250 Q2 250 Q3 250 Q4 252 Not applicable2 Critical2 not blocked2 Exploited2
Q1 23Q2 23Q3 23Q4 23Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-11201 Critical 2025-10-29 Not applicable Exploited MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
CVE-2025-49844 Critical 2025-10-03 Not applicable Exploited Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
CVE-2023-6909 High 2023-12-18 Not applicable Exploited Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
CVE-2023-3765 Critical 2023-07-19 Not applicable Working exploit published Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
CVE-2023-1177 Critical 2023-03-24 Not applicable Exploited Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.