WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor facebook✕Has a public PoC✕
Overview 10 matches · 1 in Waratek scope · 0 protected · 3 exploited · 2 CISA KEV · 4 EPSS ≥ 0.5
10matches 1in Waratek scope10.0% 0protected0.0% 3exploited30.0% 2CISA KEV20.0% 4EPSS ≥ 0.540.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 10.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 9 90.0% Withdrawn CVE 0 0.0%
Critical 2 20.0% High 5 50.0% Medium 3 30.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 10 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 30.0% Working exploit published 3 30.0% Proof of concept only 4 40.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / year
Not applicable: 9Mitigation candidate: 1 Medium: 3High: 5Critical: 2 not blocked: 10 Proof of concept only: 4Working exploit published: 3Exploited: 3
20082 Not applicable2 High2 not blocked2 Working exploit published2 20090 20100 20110 20120 20130 20140 20150 20160 20170 20180 20190 20200 20211 Not applicable1 Critical1 not blocked1 Working exploit published1 20221 Not applicable1 Medium1 not blocked1 Proof of concept only1 20231 Mitigation candidate1 High1 not blocked1 Exploited1 20240 20254 Not applicable4 Critical1 High1 Medium2 not blocked4 Exploited2 Proof of concept only2 20261 Not applicable1 High1 not blocked1 Proof of concept only1
2008201020122014201620182020202220242026
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-23870 High 2026-05-06 Not applicable Proof of concept only A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server crashes, out-of-memory exceptions or excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.5, 19.1.0 through 19.1.6, and 19.2.0 through 19.2.5).
CVE-2025-55184 High 2025-12-11 Not applicable Exploited A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.
CVE-2025-55183 Medium 2025-12-11 Not applicable Proof of concept only An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument.
CVE-2025-55182 Critical 2025-12-03 Not applicable Exploited A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.
CVE-2025-27591 Medium 2025-03-11 Not applicable Proof of concept only A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2020-20093 Medium 2022-03-23 Not applicable Proof of concept only The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages.
CVE-2021-24040 Critical 2021-09-10 Not applicable Working exploit published Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
CVE-2008-5711 High 2008-12-24 Not applicable Working exploit published Heap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to execute arbitrary code via a long FileMask property value.
CVE-2008-0660 High 2008-02-08 Not applicable Working exploit published Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties.