WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product json✕
Overview 3 matches · 1 in Waratek scope · 1 protected · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
3matches 1in Waratek scope33.3% 1protected33.3% 0CISA KEV0.0% 2public PoC66.7% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 33.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 2 66.7% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 3 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 33.3% partly blocked 0 0.0% not blocked 2 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Outside Waratek scope: 2Protected by Waratek: 1 Critical: 3 not blocked: 2blocked by ARMR today: 1 Exploited: 3
20181 Outside Waratek scope1 Critical1 not blocked1 Exploited1 20190 20200 20210 20220 20230 20240 20250 20262 Protected by Waratek1 Outside Waratek scope1 Critical2 blocked by ARMR today1 not blocked1 Exploited2
201820192020202120222023202420252026
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-16723 Critical 2026-07-23 Protected by Waratek Exploited A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVE-2025-70974 Critical 2026-01-09 Outside Waratek scope Exploited Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
CVE-2017-18349 Critical 2018-10-23 Outside Waratek scope Exploited parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.