WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2025-07-01✕Vendor org.springframework.cloud✕
Overview 2 matches · 1 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
2matches 1protected50.0% 1exploited50.0% 0CISA KEV0.0% 1public PoC50.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 50.0% Rule in development 0 0.0% Mitigation candidate 1 50.0% No exploit published 0 0.0%
Critical 2 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 50.0% partly blocked 0 0.0% not blocked 1 50.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 50.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 1 50.0%
split by peak 1 / month
Mitigation candidate: 1Protected by Waratek: 1 Critical: 2 not blocked: 1blocked by ARMR today: 1 No public exploit: 1Exploited: 1
Sep 251 Mitigation candidate1 Critical1 not blocked1 Exploited1 Oct 250 Nov 250 Dec 250 Jan 260 Feb 260 Mar 260 Apr 260 May 261 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1
Sep 25Oct 25Nov 25Dec 25Jan 26Feb 26Mar 26Apr 26May 26
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-40982 Critical 2026-05-07 Protected by Waratek No public exploit Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.
CVE-2025-41243 Critical 2025-09-16 Mitigation candidate Exploited Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.