WaratekVRT Sign in
Reset
More filters (1)
Columns
Published from 2026-04-01✕
Overview 6 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
6matches 1protected16.7% 0exploited0.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 16.7% Rule in development 0 0.0% Mitigation candidate 5 83.3% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 6 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 16.7% partly blocked 0 0.0% not blocked 5 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 6 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / month
Mitigation candidate: 5Protected by Waratek: 1 Medium: 6 not blocked: 5blocked by ARMR today: 1 Working exploit published: 6
Apr 261 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 May 261 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Jun 262 Protected by Waratek1 Mitigation candidate1 Medium2 blocked by ARMR today1 not blocked1 Working exploit published2 Jul 261 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Aug 261 Mitigation candidate1 Medium1 not blocked1 Working exploit published1
Apr 26May 26Jun 26Jul 26Aug 26
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-55549 Medium 2026-08-28 Mitigation candidate Working exploit published Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java and yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java. A crafted authorization URL can execute JavaScript when opened by a Yamcs user. The script can access browser-held authentication material and transmit it to an attacker, enabling account compromise. This issue is fixed in version 5.9.4.
CVE-2026-44595 Medium 2026-07-16 Mitigation candidate Working exploit published Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.
CVE-2026-50229 Medium 2026-06-29 Protected by Waratek Working exploit published Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
CVE-2026-42568 Medium 2026-06-10 Mitigation candidate Working exploit published Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.
CVE-2023-42343 Medium 2026-05-08 Mitigation candidate Working exploit published A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.
CVE-2026-40105 Medium 2026-04-15 Mitigation candidate Working exploit published XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through 16.10.15, 17.0.0-rc-1, through 17.4.7 and 17.5.0-rc-1 through 17.10.0 contain a reflected cross-site scripting vulnerability (XSS) in the comparison view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance. If developers are unable to update immediately, they can apply the patch manually to templates/changesdoc.vm in the deployed WAR.