WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product tiles✕
Overview 4 matches · 1 in Waratek scope · 1 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
4matches 1in Waratek scope25.0% 1protected25.0% 1exploited25.0% 0CISA KEV0.0% 1public PoC25.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 25.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 3 75.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 4 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 25.0% partly blocked 0 0.0% not blocked 3 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 25.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 75.0%
split by peak 2 / quarter
Not applicable: 3Protected by Waratek: 1 High: 4 not blocked: 3blocked by ARMR today: 1 No public exploit: 3Exploited: 1
Q3 231 Not applicable1 High1 not blocked1 No public exploit1 Q4 232 Protected by Waratek1 Not applicable1 High2 blocked by ARMR today1 not blocked1 No public exploit2 Q1 240 Q2 240 Q3 240 Q4 240 Q1 250 Q2 250 Q3 251 Not applicable1 High1 not blocked1 Exploited1
Q3 23Q4 23Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-44137 High 2025-07-29 Not applicable Exploited MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET parameters are "TileMatrix", "TileRow", "TileCol" and "Format"
CVE-2023-49735 High 2023-11-30 Protected by Waratek No public exploit ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data to this key. Passing user-controlled data to this key may be relatively common, as it was also used like that to set the language in the 'tiles-test' application shipped with Tiles. This issue affects Apache Tiles from version 2 onwards. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2023-30969 High 2023-10-26 Not applicable No public exploit The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.
CVE-2023-25482 High 2023-07-18 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in Mike Martel WP Tiles plugin <= 1.1.2 versions.