WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product parser✕
Overview 22 matches · 3 in Waratek scope · 2 protected · 2 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
22matches 3in Waratek scope13.6% 2protected9.1% 2exploited9.1% 0CISA KEV0.0% 2public PoC9.1% 1EPSS ≥ 0.54.5%
Protected by Waratek 2 9.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 4.5% Outside Waratek scope 0 0.0% Not applicable 19 86.4% Withdrawn CVE 0 0.0%
Critical 22 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 9.1% partly blocked 0 0.0% not blocked 20 90.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 9.1% Working exploit published 1 4.5% Proof of concept only 2 9.1% Forecast only 0 0.0% No public exploit 17 77.3%
split by peak 8 / year
Not applicable: 19No exploit published: 1Protected by Waratek: 2 Critical: 22 not blocked: 20blocked by ARMR today: 2 No public exploit: 17Proof of concept only: 2Working exploit published: 1Exploited: 2
20188 Not applicable8 Critical8 not blocked8 No public exploit8 20192 Not applicable2 Critical2 not blocked2 No public exploit2 20204 Not applicable4 Critical4 not blocked4 Exploited1 No public exploit3 20211 Not applicable1 Critical1 not blocked1 No public exploit1 20222 Not applicable2 Critical2 not blocked2 No public exploit2 20232 No exploit published1 Not applicable1 Critical2 not blocked2 Proof of concept only1 No public exploit1 20240 20252 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited1 Working exploit published1 20261 Not applicable1 Critical1 not blocked1 Proof of concept only1
201820192020202120222023202420252026
22 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-25896 Critical 2026-02-20 Not applicable Proof of concept only fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
CVE-2025-66516 Critical 2025-12-04 Protected by Waratek Working exploit published Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
CVE-2025-54988 Critical 2025-08-20 Protected by Waratek Exploited Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
CVE-2023-39020 Critical 2023-07-28 No exploit published Proof of concept only stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.
CVE-2023-23088 Critical 2023-02-03 Not applicable No public exploit Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via the json_value_parse function.
CVE-2022-2421 Critical 2022-10-26 Not applicable No public exploit Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
CVE-2020-28462 Critical 2022-07-25 Not applicable No public exploit This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
CVE-2021-3666 Critical 2021-09-13 Not applicable No public exploit body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVE-2020-16159 Critical 2020-10-19 Not applicable No public exploit GoPro gpmf-parser 1.5 has a heap out-of-bounds read and segfault in GPMF_ScaledData(). Parsing malicious input can result in a crash or information disclosure.
CVE-2020-13756 Critical 2020-06-03 Not applicable Exploited Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
CVE-2020-7617 Critical 2020-04-02 Not applicable No public exploit ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of Object.prototype using a '__proto__' payload.
CVE-2020-6836 Critical 2020-01-11 Not applicable No public exploit grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server.
CVE-2019-18937 Critical 2019-11-14 Not applicable No public exploit eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi script, which executes TCL script content from an HTTP POST request.
CVE-2018-20721 Critical 2019-01-16 Not applicable No public exploit URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.
CVE-2018-19199 Critical 2018-11-12 Not applicable No public exploit An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.
CVE-2018-19198 Critical 2018-11-12 Not applicable No public exploit An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts.
CVE-2018-13421 Critical 2018-07-07 Not applicable No public exploit Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a heap-based buffer over-read in io::trim_chars in csv.h.
CVE-2018-13026 Critical 2018-06-30 Not applicable No public exploit An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Type.
CVE-2018-13011 Critical 2018-06-29 Not applicable No public exploit An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Validate.
CVE-2018-13009 Critical 2018-06-29 Not applicable No public exploit An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (conditional on a buffer_size_longs check).
CVE-2018-13008 Critical 2018-06-29 Not applicable No public exploit An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for a positive nest_level.
CVE-2018-13007 Critical 2018-06-29 Not applicable No public exploit An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for GPMF_KEY_END and nest_level (not conditional on a buffer_size_longs check).