WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product console✕CISA KEV listed✕
Overview 9 matches · 6 in Waratek scope · 4 protected · 7 public PoC · 7 EPSS ≥ 0.5
9matches 6in Waratek scope66.7% 4protected44.4% 7public PoC77.8% 7EPSS ≥ 0.577.8%
Protected by Waratek 4 44.4% Rule in development 0 0.0% Mitigation candidate 2 22.2% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 3 33.3% Withdrawn CVE 0 0.0%
Critical 6 66.7% High 3 33.3% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 44.4% partly blocked 0 0.0% not blocked 5 55.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 9 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 3Mitigation candidate: 2Protected by Waratek: 4 High: 3Critical: 6 not blocked: 5blocked by ARMR today: 4 Exploited: 9
20162 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited2 20170 20180 20190 20201 Not applicable1 High1 not blocked1 Exploited1 20211 Not applicable1 High1 not blocked1 Exploited1 20223 Protected by Waratek2 Mitigation candidate1 Critical3 blocked by ARMR today2 not blocked1 Exploited3 20231 Mitigation candidate1 High1 not blocked1 Exploited1 20240 20250 20261 Not applicable1 Critical1 not blocked1 Exploited1
20162017201820192020202120222023202420252026
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-48027 Critical 2026-05-27 Not applicable Exploited Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-22965 Critical 2022-04-01 Protected by Waratek Exploited A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22963 Critical 2022-04-01 Protected by Waratek Exploited In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2022-22947 Critical 2022-03-03 Mitigation candidate Exploited In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
CVE-2021-22054 High 2021-12-17 Not applicable Exploited VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
CVE-2020-3950 High 2020-03-17 Not applicable Exploited VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.
CVE-2016-3427 Critical 2016-04-21 Protected by Waratek Exploited Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2015-7450 Critical 2016-01-02 Protected by Waratek Exploited Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.