WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product boost✕
Overview 15 matches · 0 in Waratek scope · 0 protected · 3 exploited · 1 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
15matches 0in Waratek scope0.0% 0protected0.0% 3exploited20.0% 1CISA KEV6.7% 2public PoC13.3% 1EPSS ≥ 0.56.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 15 100.0% Withdrawn CVE 0 0.0%
Critical 15 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 15 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 20.0% Working exploit published 1 6.7% Proof of concept only 1 6.7% Forecast only 0 0.0% No public exploit 10 66.7%
split by peak 3 / quarter
Not applicable: 15 Critical: 15 not blocked: 15 No public exploit: 10Proof of concept only: 1Working exploit published: 1Exploited: 3
Q3 212 Not applicable2 Critical2 not blocked2 Working exploit published1 No public exploit1 Q4 210 Q1 220 Q2 221 Not applicable1 Critical1 not blocked1 No public exploit1 Q3 220 Q4 221 Not applicable1 Critical1 not blocked1 No public exploit1 Q1 230 Q2 230 Q3 231 Not applicable1 Critical1 not blocked1 No public exploit1 Q4 231 Not applicable1 Critical1 not blocked1 Exploited1 Q1 241 Not applicable1 Critical1 not blocked1 No public exploit1 Q2 240 Q3 240 Q4 243 Not applicable3 Critical3 not blocked3 No public exploit3 Q1 250 Q2 252 Not applicable2 Critical2 not blocked2 Exploited1 Proof of concept only1 Q3 251 Not applicable1 Critical1 not blocked1 No public exploit1 Q4 251 Not applicable1 Critical1 not blocked1 No public exploit1 Q1 260 Q2 261 Not applicable1 Critical1 not blocked1 Exploited1
Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25Q4 25Q2 26
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-45321 Critical 2026-05-12 Not applicable Exploited On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
CVE-2025-13377 Critical 2025-12-06 Not applicable No public exploit The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.
CVE-2024-13342 Critical 2025-08-29 Not applicable No public exploit The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_files_to_order' function in all versions up to, and including, 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present.
CVE-2024-6584 Critical 2025-05-15 Not applicable Proof of concept only The 'wp_ajax_boost_proxy_ig' action allows administrators to make GET requests to arbitrary URLs.
CVE-2024-13744 Critical 2025-04-04 Not applicable Exploited The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2024-52428 Critical 2024-11-18 Not applicable No public exploit Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Peter Ads Booster by Ads Pro free-wp-booster-by-ads-pro allows PHP Local File Inclusion.This issue affects Ads Booster by Ads Pro: from n/a through <= 1.12.
CVE-2024-43979 Critical 2024-11-01 Not applicable No public exploit Missing Authorization vulnerability in CozyThemes Blockbooster allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockbooster: from n/a through 1.0.10.
CVE-2024-49332 Critical 2024-10-20 Not applicable No public exploit Deserialization of Untrusted Data vulnerability in giveawayboost Giveaway Boost giveaway-boost allows Object Injection.This issue affects Giveaway Boost: from n/a through <= 2.1.4.
CVE-2024-24308 Critical 2024-02-09 Not applicable No public exploit SQL Injection vulnerability in Boostmyshop (boostmyshopagent) module for Prestashop versions 1.1.9 and before, allows remote attackers to escalate privileges and obtain sensitive information via changeOrderCarrier.php, relayPoint.php, and shippingConfirmation.php.
CVE-2023-5559 Critical 2023-11-27 Not applicable Exploited The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.
CVE-2023-3935 Critical 2023-09-13 Not applicable No public exploit A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attacker to achieve RCE and gain full access of the host system.
CVE-2022-2052 Critical 2022-10-17 Not applicable No public exploit Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.
CVE-2022-1300 Critical 2022-05-02 Not applicable No public exploit Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication. Execution of this function may result in unauthorized access to change of data or disruption of the whole service.
CVE-2021-41392 Critical 2021-09-17 Not applicable No public exploit static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API.
CVE-2021-34646 Critical 2021-08-30 Not applicable Working exploit published Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link function found in the ~/includes/class-wcj-emails-verification.php file. This allows attackers to impersonate users and trigger an email address verification for arbitrary accounts, including administrative accounts, and automatically be logged in as that user, including any site administrators. This requires the Email Verification module to be active in the plugin and the Login User After Successful Verification setting to be enabled, which it is by default.