WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product github✕
Overview 5 matches · 1 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
5matches 1in Waratek scope20.0% 0protected0.0% 1exploited20.0% 0CISA KEV0.0% 1public PoC20.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 20.0% Outside Waratek scope 0 0.0% Not applicable 4 80.0% Withdrawn CVE 0 0.0%
Critical 5 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 20.0% Working exploit published 0 0.0% Proof of concept only 1 20.0% Forecast only 0 0.0% No public exploit 3 60.0%
split by peak 1 / year
Not applicable: 4No exploit published: 1 Critical: 5 not blocked: 5 No public exploit: 3Proof of concept only: 1Exploited: 1
20191 Not applicable1 Critical1 not blocked1 Exploited1 20201 Not applicable1 Critical1 not blocked1 No public exploit1 20211 Not applicable1 Critical1 not blocked1 No public exploit1 20220 20230 20241 Not applicable1 Critical1 not blocked1 Proof of concept only1 20250 20261 No exploit published1 Critical1 not blocked1 No public exploit1
20192020202120222023202420252026
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-42523 Critical 2026-04-29 No exploit published No public exploit Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part of JavaScript implementing validation of the feature "GitHub hook trigger for GITScm polling", resulting in a stored cross-site scripting (XSS) vulnerability exploitable by non-anonymous attackers with Overall/Read permission.
CVE-2023-47846 Critical 2024-03-26 Not applicable Proof of concept only Unrestricted Upload of File with Dangerous Type vulnerability in Terry Lin WP Githuber MD.This issue affects WP Githuber MD: from n/a through 1.16.2.
CVE-2021-44684 Critical 2021-12-07 Not applicable No public exploit naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.
CVE-2020-10516 Critical 2020-06-03 Not applicable No public exploit An improper access control vulnerability was identified in the GitHub Enterprise Server API that allowed an organization member to escalate permissions and gain access to unauthorized repositories within an organization. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.21 and was fixed in 2.20.9, 2.19.15, and 2.18.20. This vulnerability was reported via the GitHub Bug Bounty program.
CVE-2017-18365 Critical 2019-03-28 Not applicable Exploited The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to execute arbitrary code. This occurs because the enterprise session secret is always the same, and can be found in the product's source code. By sending a crafted cookie signed with this secret, one can call Marshal.load with arbitrary data, which is a problem because the Marshal data format allows Ruby objects.