WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product JSON✕
Overview 54 matches · 7 in Waratek scope · 3 protected · 3 exploited · 0 CISA KEV · 5 public PoC · 1 EPSS ≥ 0.5
54matches 7in Waratek scope13.0% 3protected5.6% 3exploited5.6% 0CISA KEV0.0% 5public PoC9.3% 1EPSS ≥ 0.51.9%
Protected by Waratek 3 5.6% Rule in development 0 0.0% Mitigation candidate 1 1.9% No exploit published 3 5.6% Outside Waratek scope 3 5.6% Not applicable 44 81.5% Withdrawn CVE 0 0.0%
Critical 54 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 5.6% partly blocked 0 0.0% not blocked 51 94.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 5.6% Working exploit published 1 1.9% Proof of concept only 12 22.2% Forecast only 0 0.0% No public exploit 38 70.4%
split by peak 11 / year
Not applicable: 44Outside Waratek scope: 3No exploit published: 3Mitigation candidate: 1Protected by Waratek: 3 Critical: 54 not blocked: 51blocked by ARMR today: 3 No public exploit: 38Proof of concept only: 12Working exploit published: 1Exploited: 3
20184 Outside Waratek scope1 Not applicable3 Critical4 not blocked4 Exploited1 Proof of concept only1 No public exploit2 20193 Not applicable3 Critical3 not blocked3 No public exploit3 20207 Protected by Waratek1 Not applicable6 Critical7 blocked by ARMR today1 not blocked6 No public exploit7 202111 Protected by Waratek1 Not applicable10 Critical11 blocked by ARMR today1 not blocked10 Working exploit published1 No public exploit10 202211 Mitigation candidate1 Not applicable10 Critical11 not blocked11 Proof of concept only4 No public exploit7 20239 No exploit published3 Outside Waratek scope1 Not applicable5 Critical9 not blocked9 Proof of concept only4 No public exploit5 20244 Not applicable4 Critical4 not blocked4 Proof of concept only2 No public exploit2 20252 Not applicable2 Critical2 not blocked2 Proof of concept only1 No public exploit1 20263 Protected by Waratek1 Outside Waratek scope1 Not applicable1 Critical3 blocked by ARMR today1 not blocked2 Exploited2 No public exploit1
201820192020202120222023202420252026
54 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-16723 Critical 2026-07-23 Protected by Waratek Exploited A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVE-2025-61140 Critical 2026-01-28 Not applicable No public exploit The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.
CVE-2025-70974 Critical 2026-01-09 Outside Waratek scope Exploited Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
CVE-2025-57052 Critical 2025-09-03 Not applicable Proof of concept only cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
CVE-2024-13258 Critical 2025-01-09 Not applicable No public exploit Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.
CVE-2024-38984 Critical 2024-07-30 Not applicable Proof of concept only Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the __proto__ property.
CVE-2024-6624 Critical 2024-07-11 Not applicable No public exploit The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper controls on custom user meta fields. This makes it possible for unauthenticated attackers to register as administrators on the site. The plugin requires the JSON API plugin to also be installed.
CVE-2024-38993 Critical 2024-07-01 Not applicable Proof of concept only rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
CVE-2024-27307 Critical 2024-03-06 Not applicable No public exploit JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the `Object` constructor and prototype. This may lead to denial of service, remote code execution or other unexpected behavior in applications that evaluate user-provided JSONata expressions. This issue has been fixed in JSONata versions 1.8.7 and 2.0.4. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation. As a workaround, one may apply the patch manually.
CVE-2023-42277 Critical 2023-09-08 No exploit published Proof of concept only hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.
CVE-2023-42276 Critical 2023-09-08 No exploit published Proof of concept only hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.
CVE-2021-32292 Critical 2023-08-22 Outside Waratek scope Proof of concept only An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.
CVE-2022-47937 Critical 2023-05-15 No exploit published No public exploit Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.
CVE-2023-27849 Critical 2023-04-24 Not applicable Proof of concept only rails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
CVE-2021-4329 Critical 2023-03-05 Not applicable No public exploit A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227. It is recommended to upgrade the affected component. VDB-222266 is the identifier assigned to this vulnerability.
CVE-2023-23088 Critical 2023-02-03 Not applicable No public exploit Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse function.
CVE-2023-23087 Critical 2023-02-03 Not applicable No public exploit An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.
CVE-2023-23086 Critical 2023-02-03 Not applicable No public exploit Buffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function.
CVE-2022-4742 Critical 2022-12-26 Not applicable No public exploit A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. Upgrading to version 0.6.2 is able to address this issue. The patch is identified as 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to upgrade the affected component. VDB-216794 is the identifier assigned to this vulnerability.
CVE-2021-4279 Critical 2022-12-25 Not applicable No public exploit A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.
CVE-2022-44109 Critical 2022-12-19 Not applicable Proof of concept only pdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream::makeFilter(char*, Stream*, Object*, int).
CVE-2022-44108 Critical 2022-12-19 Not applicable Proof of concept only pdftojson commit 94204bb was discovered to contain a stack overflow via the component Object::copy(Object*):Object.cc.
CVE-2022-41382 Critical 2022-10-11 Not applicable No public exploit The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
CVE-2022-38882 Critical 2022-09-19 Not applicable No public exploit The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
CVE-2022-25921 Critical 2022-08-29 Not applicable No public exploit All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor.
CVE-2022-23459 Critical 2022-08-19 Not applicable No public exploit Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memory corruption via a double free or via a use after free. The value class has a default assignment operator which may be used with pointer types which may point to alterable data where the pointer itself is not updated. This issue exists on the current commit of the jsonxx project. The project itself has been archived and updates are not expected. Users are advised to find a replacement.
CVE-2022-36010 Critical 2022-08-15 Not applicable Proof of concept only This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunctionValue.js). To do this, Javascript's [`eval`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) function is used to execute strings that begin with "function" as Javascript. This unfortunately could allow arbitrary code to be executed if it exists as a value within the JSON structure being displayed. Given that this component may often be used to display data from arbitrary, untrusted sources, this is extremely dangerous. One important note is that users who have defined a custom [`onSubmitValueParser`](https://github.com/oxyno-zeta/react-editable-json-tree/tree/09a0ca97835b0834ad054563e2fddc6f22bc5d8c#onsubmitvalueparser) callback prop on the [`JsonTree`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/JsonTree.js) component should be ***unaffected***. This vulnerability exists in the default `onSubmitValueParser` prop which calls [`parse`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/master/src/utils/parse.js#L30). Prop is added to `JsonTree` called `allowFunctionEvaluation`. This prop will be set to `true` in v2.2.2, which allows upgrade without losing backwards-compatibility. In v2.2.2, we switched from using `eval` to using [`Function`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function) to construct anonymous functions. This is better than `eval` for the following reasons: - Arbitrary code should not be able to execute immediately, since the `Function` constructor explicitly *only creates* anonymous functions - Functions are created without local closures, so they only have access to the global scope If you use: - **Version `<2.2.2`**, you must upgrade as soon as possible. - **Version `^2.2.2`**, you must explicitly set `JsonTree`'s `allowFunctionEvaluation` prop to `false` to fully mitigate this vulnerability. - **Version `>=3.0.0`**, `allowFunctionEvaluation` is already set to `false` by default, so no further steps are necessary.
CVE-2022-25845 Critical 2022-06-10 Mitigation candidate Proof of concept only The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
CVE-2022-23631 Critical 2022-02-09 Not applicable No public exploit superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. This has been patched in superjson 1.8.1. Users are advised to update. There are no known workarounds for this issue.
CVE-2021-3918 Critical 2021-11-13 Not applicable No public exploit json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVE-2020-23878 Critical 2021-11-10 Not applicable No public exploit pdf2json v0.71 was discovered to contain a stack buffer overflow in the component XRef::fetch.
CVE-2021-23820 Critical 2021-11-03 Not applicable No public exploit This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.
CVE-2021-23807 Critical 2021-11-03 Not applicable No public exploit This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
CVE-2021-23509 Critical 2021-11-03 Not applicable No public exploit This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.
CVE-2020-28429 Critical 2021-02-23 Not applicable Working exploit published All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
CVE-2021-23899 Critical 2021-01-13 Protected by Waratek No public exploit OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
CVE-2016-20005 Critical 2021-01-01 Not applicable No public exploit The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVE-2016-20004 Critical 2021-01-01 Not applicable No public exploit The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVE-2016-20002 Critical 2021-01-01 Not applicable No public exploit The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVE-2016-20001 Critical 2021-01-01 Not applicable No public exploit The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.
CVE-2020-29203 Critical 2020-12-26 Not applicable No public exploit struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J_STRUCT_GET_string_ELEMENT.
CVE-2020-22083 Critical 2020-12-17 Not applicable No public exploit jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution, and must not be used with un-trusted data
CVE-2020-7770 Critical 2020-11-12 Not applicable No public exploit This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
CVE-2020-7766 Critical 2020-11-10 Not applicable No public exploit This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
CVE-2020-17479 Critical 2020-08-10 Not applicable No public exploit jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.
CVE-2018-21234 Critical 2020-05-21 Protected by Waratek No public exploit Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
CVE-2020-10594 Critical 2020-03-15 Not applicable No public exploit An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.
CVE-2019-11835 Critical 2019-05-09 Not applicable No public exploit cJSON before 1.7.11 allows out-of-bounds access, related to multiline comments.
CVE-2019-11834 Critical 2019-05-09 Not applicable No public exploit cJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal.
CVE-2016-10749 Critical 2019-04-29 Not applicable No public exploit parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character.
CVE-2017-18349 Critical 2018-10-23 Outside Waratek scope Exploited parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
CVE-2018-17072 Critical 2018-09-16 Not applicable No public exploit JSON++ through 2016-06-15 has a buffer over-read in yyparse() in json.y.
CVE-2018-1000217 Critical 2018-08-20 Not applicable No public exploit Dave Gamble cJSON version 1.7.3 and earlier contains a CWE-416: Use After Free vulnerability in cJSON library that can result in Possible crash, corruption of data or even RCE. This attack appear to be exploitable via Depends on how application uses cJSON library. If application provides network interface then can be exploited over a network, otherwise just local.. This vulnerability appears to have been fixed in 1.7.4.
CVE-2015-9235 Critical 2018-05-29 Not applicable Proof of concept only In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).