WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product observability✕
Overview 7 matches · 1 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
7matches 1in Waratek scope14.3% 0protected0.0% 1exploited14.3% 1CISA KEV14.3% 1public PoC14.3% 1EPSS ≥ 0.514.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 14.3% No exploit published 0 0.0% Outside Waratek scope 1 14.3% Not applicable 5 71.4% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 7 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 85.7%
split by peak 3 / quarter
Not applicable: 5Outside Waratek scope: 1Mitigation candidate: 1 High: 7 not blocked: 7 No public exploit: 6Exploited: 1
Q3 231 Not applicable1 High1 not blocked1 No public exploit1 Q4 231 Mitigation candidate1 High1 not blocked1 Exploited1 Q1 240 Q2 240 Q3 240 Q4 240 Q1 250 Q2 251 Not applicable1 High1 not blocked1 No public exploit1 Q3 251 Not applicable1 High1 not blocked1 No public exploit1 Q4 250 Q1 263 Outside Waratek scope1 Not applicable2 High3 not blocked3 No public exploit3
Q3 23Q4 23Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25Q1 26
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-28298 High 2026-03-26 Not applicable No public exploit SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.
CVE-2026-28297 High 2026-03-26 Not applicable No public exploit SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.
CVE-2026-29063 High 2026-03-06 Outside Waratek scope No public exploit Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
CVE-2025-26397 High 2025-07-24 Not applicable No public exploit SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication from a low-level account and local access to the host server.
CVE-2025-26395 High 2025-06-10 Not applicable No public exploit SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL. The attack requires authentication using an administrator-level account and user interaction is required.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-0813 High 2023-09-15 Not applicable No public exploit A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without authentication.