WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product process automation✕
Overview 12 matches · 6 in Waratek scope · 1 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
12matches 6in Waratek scope50.0% 1protected8.3% 1exploited8.3% 1CISA KEV8.3% 1public PoC8.3% 1EPSS ≥ 0.58.3%
Protected by Waratek 1 8.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 5 41.7% Outside Waratek scope 0 0.0% Not applicable 6 50.0% Withdrawn CVE 0 0.0%
Critical 12 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 8.3% partly blocked 0 0.0% not blocked 11 91.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 8.3% Working exploit published 0 0.0% Proof of concept only 2 16.7% Forecast only 0 0.0% No public exploit 9 75.0%
split by peak 4 / year
Not applicable: 6No exploit published: 5Protected by Waratek: 1 Critical: 12 not blocked: 11blocked by ARMR today: 1 No public exploit: 9Proof of concept only: 2Exploited: 1
20191 Not applicable1 Critical1 not blocked1 No public exploit1 20201 No exploit published1 Critical1 not blocked1 No public exploit1 20211 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20223 Not applicable3 Critical3 not blocked3 Proof of concept only1 No public exploit2 20232 Not applicable2 Critical2 not blocked2 No public exploit2 20240 20250 20264 No exploit published4 Critical4 not blocked4 Proof of concept only1 No public exploit3
20192020202120222023202420252026
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-28369 Critical 2026-03-27 No exploit published No public exploit A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.
CVE-2026-28368 Critical 2026-03-27 No exploit published No public exploit A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
CVE-2026-28367 Critical 2026-03-27 No exploit published No public exploit A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
CVE-2025-12543 Critical 2026-01-07 No exploit published Proof of concept only A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.
CVE-2023-43058 Critical 2023-10-06 Not applicable No public exploit IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects. IBM X-Force ID: 247527.
CVE-2023-38734 Critical 2023-08-22 Not applicable No public exploit IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481.
CVE-2022-35280 Critical 2022-08-10 Not applicable No public exploit IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.
CVE-2022-2457 Critical 2022-08-10 Not applicable Proof of concept only A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts.
CVE-2022-22413 Critical 2022-05-12 Not applicable No public exploit IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 223022.
CVE-2021-44228 Critical 2021-12-10 Protected by Waratek Exploited Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVE-2019-14892 Critical 2020-03-02 No exploit published No public exploit A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
CVE-2019-4336 Critical 2019-07-01 Not applicable No public exploit IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411.