WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product common✕CISA KEV listed✕
Overview 7 matches · 5 in Waratek scope · 4 protected · 6 public PoC · 6 EPSS ≥ 0.5
7matches 5in Waratek scope71.4% 4protected57.1% 6public PoC85.7% 6EPSS ≥ 0.585.7%
Protected by Waratek 4 57.1% Rule in development 0 0.0% Mitigation candidate 1 14.3% No exploit published 0 0.0% Outside Waratek scope 1 14.3% Not applicable 1 14.3% Withdrawn CVE 0 0.0%
Critical 5 71.4% High 2 28.6% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 57.1% partly blocked 0 0.0% not blocked 3 42.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 7 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 1Outside Waratek scope: 1Mitigation candidate: 1Protected by Waratek: 4 High: 2Critical: 5 not blocked: 3blocked by ARMR today: 4 Exploited: 7
20161 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20170 20181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20190 20201 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20211 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20220 20231 Mitigation candidate1 High1 not blocked1 Exploited1 20240 20250 20262 Outside Waratek scope1 Not applicable1 Critical2 not blocked2 Exploited2
20162017201820192020202120222023202420252026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-111497 Critical 2026-10-22 Outside Waratek scope Exploited A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVE-2026-45321 Critical 2026-05-12 Not applicable Exploited On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2021-44228 Critical 2021-12-10 Protected by Waratek Exploited Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVE-2020-1956 High 2020-05-22 Protected by Waratek Exploited Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
CVE-2018-1273 Critical 2018-04-11 Protected by Waratek Exploited Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVE-2015-7450 Critical 2016-01-02 Protected by Waratek Exploited Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.