WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product json✕Has a public PoC✕
Overview 5 matches · 2 in Waratek scope · 1 protected · 2 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
5matches 2in Waratek scope40.0% 1protected20.0% 2exploited40.0% 0CISA KEV0.0% 1EPSS ≥ 0.520.0%
Protected by Waratek 1 20.0% Rule in development 0 0.0% Mitigation candidate 1 20.0% No exploit published 0 0.0% Outside Waratek scope 1 20.0% Not applicable 2 40.0% Withdrawn CVE 0 0.0%
Critical 5 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 20.0% partly blocked 0 0.0% not blocked 4 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 40.0% Working exploit published 1 20.0% Proof of concept only 2 40.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 2Outside Waratek scope: 1Mitigation candidate: 1Protected by Waratek: 1 Critical: 5 not blocked: 4blocked by ARMR today: 1 Proof of concept only: 2Working exploit published: 1Exploited: 2
20182 Outside Waratek scope1 Not applicable1 Critical2 not blocked2 Exploited1 Proof of concept only1 20190 20200 20211 Not applicable1 Critical1 not blocked1 Working exploit published1 20221 Mitigation candidate1 Critical1 not blocked1 Proof of concept only1 20230 20240 20250 20261 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1
201820192020202120222023202420252026
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-16723 Critical 2026-07-23 Protected by Waratek Exploited A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVE-2022-25845 Critical 2022-06-10 Mitigation candidate Proof of concept only The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
CVE-2020-28429 Critical 2021-02-23 Not applicable Working exploit published All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
CVE-2017-18349 Critical 2018-10-23 Outside Waratek scope Exploited parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
CVE-2015-9235 Critical 2018-05-29 Not applicable Proof of concept only In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).