WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product fastjson✕Has a public PoC✕
Overview 3 matches · 2 in Waratek scope · 1 protected · 2 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
3matches 2in Waratek scope66.7% 1protected33.3% 2exploited66.7% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 33.3% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 0 0.0% Outside Waratek scope 1 33.3% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 3 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 33.3% partly blocked 0 0.0% not blocked 2 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 66.7% Working exploit published 0 0.0% Proof of concept only 1 33.3% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / year
Outside Waratek scope: 1Mitigation candidate: 1Protected by Waratek: 1 Critical: 3 not blocked: 2blocked by ARMR today: 1 Proof of concept only: 1Exploited: 2
20181 Outside Waratek scope1 Critical1 not blocked1 Exploited1 20190 20200 20210 20221 Mitigation candidate1 Critical1 not blocked1 Proof of concept only1 20230 20240 20250 20261 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1
201820192020202120222023202420252026
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-16723 Critical 2026-07-23 Protected by Waratek Exploited A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVE-2022-25845 Critical 2022-06-10 Mitigation candidate Proof of concept only The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
CVE-2017-18349 Critical 2018-10-23 Outside Waratek scope Exploited parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.