Overview 4 matches · 3 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
4matches
3in Waratek scope75.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
1public PoC25.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
75.0%
Outside Waratek scope
0
0.0%
Not applicable
1
25.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
4
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
25.0%
Proof of concept only
1
25.0%
Forecast only
0
0.0%
No public exploit
2
50.0%
split by
peak 2 / year
20011
Not applicable1
Medium1
not blocked1
Working exploit published1
20020
20030
20040
20050
20060
20070
20080
20090
20100
20110
20120
20130
20140
20150
20160
20170
20182
No exploit published2
High1
Medium1
not blocked2
No public exploit2
20190
20200
20210
20220
20230
20240
20250
20261
No exploit published1
Low1
not blocked1
Proof of concept only1
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-11477 | Low | 2026-06-08 | No exploit published | Proof of concept only | A vulnerability was detected in hs-web hsweb-framework up to 5.0.1. This affects the function OAuth2Client of the file hsweb-authorization/hsweb-authorization-oauth2/src/main/java/org/hswebframework/web/oauth2/server/OAuth2Client.java of the component OAuth2 Client. The manipulation results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as c2882679a9125cea52678151af5ae213cbd52579. Applying a patch is advised to resolve this issue. |
| CVE-2018-20595 | High | 2018-12-30 | No exploit published | No public exploit | A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful. |
| CVE-2018-20594 | Medium | 2018-12-30 | No exploit published | No public exploit | An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java. |
| CVE-2001-0200 | Medium | 2001-05-03 | Not applicable | Working exploit published | HSWeb 2.0 HTTP server allows remote attackers to obtain the physical path of the server via a request to the /cgi/ directory, which will list the path if directory browsing is enabled. |