WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product apollo✕
Overview 4 matches · 2 in Waratek scope · 1 protected · 2 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
4matches 2in Waratek scope50.0% 1protected25.0% 2exploited50.0% 1CISA KEV25.0% 1public PoC25.0% 1EPSS ≥ 0.525.0%
Protected by Waratek 1 25.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 25.0% Outside Waratek scope 0 0.0% Not applicable 2 50.0% Withdrawn CVE 0 0.0%
Critical 4 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 25.0% partly blocked 0 0.0% not blocked 3 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 50.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 50.0%
split by peak 1 / year
Not applicable: 2No exploit published: 1Protected by Waratek: 1 Critical: 4 not blocked: 3blocked by ARMR today: 1 No public exploit: 2Exploited: 2
20171 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20180 20191 No exploit published1 Critical1 not blocked1 No public exploit1 20200 20210 20220 20230 20241 Not applicable1 Critical1 not blocked1 Exploited1 20250 20261 Not applicable1 Critical1 not blocked1 Exploited1
2017201820192020202120222023202420252026
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-45321 Critical 2026-05-12 Not applicable Exploited On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
CVE-2024-25735 Critical 2024-03-27 Not applicable Exploited An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.
CVE-2019-10686 Critical 2019-04-01 No exploit published No public exploit An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.
CVE-2014-3579 Critical 2017-10-27 Protected by Waratek No public exploit XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.