library CVEs · Protected by Waratek · Low

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

2matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%

Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 2 100.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 100.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Nov 241 Protected by Waratek1 Low1 blocked by ARMR today1 No public exploit1 Dec 240 Jan 250 Feb 250 Mar 250 Apr 250 May 250 Jun 250 Jul 250 Aug 250 Sep 250 Oct 250 Nov 251 Protected by Waratek1 Low1 blocked by ARMR today1 No public exploit1

Nov 24Jan 25Mar 25May 25Jul 25Sep 25Nov 25

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2025-66372	Low	2025-11-28	Protected by Waratek	No public exploit	Mustang before 2.16.3 allows exfiltrating files via XXE attacks.
CVE-2024-52800	Low	2024-11-29	Protected by Waratek	No public exploit	veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2025-66372

Low

2025-11-28

Protected by Waratek

No public exploit

Mustang before 2.16.3 allows exfiltrating files via XXE attacks.

CVE-2024-52800

Low

2024-11-29

Protected by Waratek

No public exploit

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.