WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product java sdk✕
Overview 9 matches · 6 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
9matches 6in Waratek scope66.7% 1protected11.1% 0exploited0.0% 0CISA KEV0.0% 2public PoC22.2% 1EPSS ≥ 0.511.1%
Protected by Waratek 1 11.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 5 55.6% Outside Waratek scope 2 22.2% Not applicable 1 11.1% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 9 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 11.1% partly blocked 0 0.0% not blocked 8 88.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 22.2% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 77.8%
split by peak 2 / year
Not applicable: 1Outside Waratek scope: 2No exploit published: 5Protected by Waratek: 1 High: 9 not blocked: 8blocked by ARMR today: 1 No public exploit: 7Working exploit published: 2
20041 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20051 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20060 20070 20080 20090 20100 20110 20120 20130 20140 20152 No exploit published2 High2 not blocked2 No public exploit2 20162 Protected by Waratek1 No exploit published1 High2 blocked by ARMR today1 not blocked1 No public exploit2 20170 20181 No exploit published1 High1 not blocked1 No public exploit1 20190 20201 Not applicable1 High1 not blocked1 No public exploit1 20210 20220 20230 20240 20250 20261 No exploit published1 High1 not blocked1 No public exploit1
200420062008201020122014201620182020202220242026
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-35568 High 2026-04-07 No exploit published No public exploit MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to 1.0.0, the java-sdk contains a DNS rebinding vulnerability. This vulnerability allows an attacker to access a locally or network-private java-sdk MCP server via a victims browser that is either local, or network adjacent. This allows an attacker to make any tool call to the server as if they were a locally running MCP connected AI agent. This vulnerability is fixed in 1.0.0.
CVE-2020-9040 High 2020-06-08 Not applicable No public exploit Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker can leverage this flaw by crafting a cryptographically valid certificate that will be accepted by Java SDK's Netty component due to missing hostname verification.
CVE-2018-1417 High 2018-02-22 No exploit published No public exploit Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevate its privileges. IBM X-Force ID: 138823.
CVE-2016-0376 High 2016-06-03 Protected by Waratek No public exploit The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.
CVE-2016-0363 High 2016-06-03 No exploit published No public exploit The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.
CVE-2014-8892 High 2015-03-06 No exploit published No public exploit Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via unspecified vectors related to the security manager.
CVE-2014-8891 High 2015-03-06 No exploit published No public exploit Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vectors related to the security manager.
CVE-2004-1029 High 2005-03-01 Outside Waratek scope Working exploit published The Sun Java Plugin capability in Java 2 Runtime Environment (JRE) 1.4.2_01, 1.4.2_04, and possibly earlier versions, does not properly restrict access between Javascript and Java applets during data transfer, which allows remote attackers to load unsafe classes and execute arbitrary code by using the reflection API to access private Java packages.
CVE-2004-0204 High 2004-08-06 Outside Waratek scope Working exploit published Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.