WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product plot✕
Overview 28 matches · 3 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
28matches 3in Waratek scope10.7% 2protected7.1% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 7.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 3.6% Outside Waratek scope 0 0.0% Not applicable 25 89.3% Withdrawn CVE 0 0.0%
Critical 5 17.9% High 10 35.7% Medium 13 46.4% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 7.1% partly blocked 0 0.0% not blocked 26 92.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 28 100.0%
split by peak 9 / year
Not applicable: 25No exploit published: 1Protected by Waratek: 2 Medium: 13High: 10Critical: 5 not blocked: 26blocked by ARMR today: 2 No public exploit: 28
20021 Not applicable1 High1 not blocked1 No public exploit1 20030 20040 20050 20060 20070 20080 20091 Not applicable1 High1 not blocked1 No public exploit1 20100 20110 20120 20130 20140 20150 20160 20172 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20183 Not applicable3 High3 not blocked3 No public exploit3 20191 Not applicable1 Medium1 not blocked1 No public exploit1 20204 No exploit published1 Not applicable3 Critical1 High1 Medium2 not blocked4 No public exploit4 20212 Not applicable2 Critical1 Medium1 not blocked2 No public exploit2 20222 Protected by Waratek2 Critical1 High1 blocked by ARMR today2 No public exploit2 20231 Not applicable1 Medium1 not blocked1 No public exploit1 20241 Not applicable1 Critical1 not blocked1 No public exploit1 20259 Not applicable9 Critical1 High1 Medium7 not blocked9 No public exploit9 20261 Not applicable1 High1 not blocked1 No public exploit1
2002200420062008201020122014201620182020202220242026
28 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-55810 High 2026-07-10 Not applicable No public exploit Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.
CVE-2013-1424 Medium 2025-06-26 Not applicable No public exploit Buffer overflow vulnerability in matplotlib.This issue affects matplotlib: before upstream commit ba4016014cb4fb4927e36ce8ea429fed47dcb787.
CVE-2025-45331 High 2025-06-20 Not applicable No public exploit brplot v420.69.1 contains a Null Pointer Dereference (NPD) vulnerability in the br_dagens_handle_once function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes.
CVE-2025-31177 Medium 2025-05-07 Not applicable No public exploit gnuplot is affected by a heap buffer overflow at function utf8_copy_one.
CVE-2025-31181 Medium 2025-03-27 Not applicable No public exploit A flaw was found in gnuplot. The X11_graphics() function may lead to a segmentation fault and cause a system crash.
CVE-2025-31180 Medium 2025-03-27 Not applicable No public exploit A flaw was found in gnuplot. The CANVAS_text() function may lead to a segmentation fault and cause a system crash.
CVE-2025-31179 Medium 2025-03-27 Not applicable No public exploit A flaw was found in gnuplot. The xstrftime() function may lead to a segmentation fault, causing a system crash.
CVE-2025-31178 Medium 2025-03-27 Not applicable No public exploit A flaw was found in gnuplot. The GetAnnotateString() function may lead to a segmentation fault and cause a system crash.
CVE-2025-31176 Medium 2025-03-27 Not applicable No public exploit A flaw was found in gnuplot. The plot3d_points() function may lead to a segmentation fault and cause a system crash.
CVE-2025-1497 Critical 2025-03-10 Not applicable No public exploit A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requires uncommenting it and thus accepting the risk. The vendor does not plan to release a patch to fix this vulnerability.
CVE-2023-46308 Critical 2024-01-03 Not applicable No public exploit In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.
CVE-2023-30874 Medium 2023-08-17 Not applicable No public exploit Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Steve Curtis, St. Pete Design Gps Plotter plugin <= 5.1.4 versions.
CVE-2022-46682 Critical 2022-12-12 Protected by Waratek No public exploit Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-28154 High 2022-03-29 Protected by Waratek No public exploit Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-44917 Medium 2021-12-21 Not applicable No public exploit A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash.
CVE-2021-29369 Critical 2021-05-03 Not applicable No public exploit The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.
CVE-2020-25559 High 2020-09-16 Not applicable No public exploit gnuplot 5.5 is affected by double free when executing print_set_output. This may result in context-dependent arbitrary code execution.
CVE-2020-25412 Critical 2020-09-16 Not applicable No public exploit com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution.
CVE-2020-2265 Medium 2020-09-16 No exploit published No public exploit Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to the plugin's post-build step.
CVE-2015-5484 Medium 2020-01-15 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a post.
CVE-2015-9347 Medium 2019-08-27 Not applicable No public exploit The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
CVE-2018-19492 High 2018-11-23 Not applicable No public exploit An issue was discovered in cairo.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the cairotrm_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot pngcairo terminal is used as a backend.
CVE-2018-19491 High 2018-11-23 Not applicable No public exploit An issue was discovered in post.trm in Gnuplot 5.2.5. This issue allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the PS_options function. This flaw is caused by a missing size check of an argument passed to the "set font" function. This issue occurs when the Gnuplot postscript terminal is used as a backend.
CVE-2018-19490 High 2018-11-23 Not applicable No public exploit An issue was discovered in datafile.c in Gnuplot 5.2.5. This issue allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in df_generate_ascii_array_entry. To exploit this vulnerability, an attacker must pass an overlong string as the right bound of the range argument that is passed to the plot function.
CVE-2017-1000006 Medium 2017-07-17 Not applicable No public exploit Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.
CVE-2017-9670 High 2017-06-15 Not applicable No public exploit An uninitialized stack variable vulnerability in load_tic_series() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact when a victim opens a specially crafted file.
CVE-2009-3329 High 2009-09-23 Not applicable No public exploit Stack-based buffer overflow in Winplot 1.25.0.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Plot2D (.wp2) file.
CVE-2002-2259 High 2002-12-31 Not applicable No public exploit Buffer overflow in the French documentation patch for Gnuplot 3.7 in SuSE Linux before 8.0 allows local users to execute arbitrary code as root via unknown attack vectors.