WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product groovy✕
Overview 16 matches · 10 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
16matches 10in Waratek scope62.5% 1protected6.2% 0exploited0.0% 0CISA KEV0.0% 1public PoC6.2% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 6.2% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 9 56.2% Outside Waratek scope 2 12.5% Not applicable 4 25.0% Withdrawn CVE 0 0.0%
Critical 4 25.0% High 4 25.0% Medium 7 43.8% Low 1 6.2% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 6.2% partly blocked 0 0.0% not blocked 15 93.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 6.2% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 15 93.8%
split by peak 4 / year
Not applicable: 4Outside Waratek scope: 2No exploit published: 9Protected by Waratek: 1 Low: 1Medium: 7High: 4Critical: 4 not blocked: 15blocked by ARMR today: 1 No public exploit: 15Working exploit published: 1
20101 Not applicable1 Medium1 not blocked1 No public exploit1 20110 20120 20131 Not applicable1 Medium1 not blocked1 Working exploit published1 20140 20151 Outside Waratek scope1 Critical1 not blocked1 No public exploit1 20160 20171 Not applicable1 High1 not blocked1 No public exploit1 20182 Outside Waratek scope1 Not applicable1 Critical1 Medium1 not blocked2 No public exploit2 20194 No exploit published4 High2 Medium1 Low1 not blocked4 No public exploit4 20201 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20210 20222 No exploit published2 Critical2 not blocked2 No public exploit2 20230 20240 20250 20263 No exploit published3 High1 Medium2 not blocked3 No public exploit3
201020122014201620182020202220242026
16 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-57284 Medium 2026-06-24 No exploit published No public exploit Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration other than Pipeline steps.
CVE-2026-57283 Medium 2026-06-24 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier allows attackers to instantiate types related to job or system configuration other than Pipeline steps through the Pipeline Snippet Generator.
CVE-2026-48921 High 2026-05-27 No exploit published No public exploit Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
CVE-2022-43406 Critical 2022-10-19 No exploit published No public exploit A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVE-2022-43405 Critical 2022-10-19 No exploit published No public exploit A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
CVE-2020-17521 Medium 2020-12-07 Protected by Waratek No public exploit Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
CVE-2019-10753 Medium 2019-09-05 No exploit published No public exploit In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.
CVE-2019-11808 Low 2019-05-07 No exploit published No public exploit Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.
CVE-2019-1003033 High 2019-03-08 No exploit published No public exploit A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003006 High 2019-02-06 No exploit published No public exploit A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/StringScriptSource.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2018-1000202 Medium 2018-06-05 Not applicable No public exploit A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
CVE-2016-6814 Critical 2018-01-18 Outside Waratek scope No public exploit When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
CVE-2016-6497 High 2017-01-18 Not applicable No public exploit main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods.
CVE-2015-3253 Critical 2015-08-13 Outside Waratek scope No public exploit The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
CVE-2013-2760 Medium 2013-04-16 Not applicable Working exploit published Buffer overflow in Groovy Media Player 3.2.0 allows remote attackers to execute arbitrary code via a long string in a .m3u file.
CVE-2009-4931 Medium 2010-07-12 Not applicable No public exploit Stack-based buffer overflow in Groovy Media Player 1.1.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .m3u playlist file.