Overview 19 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
19matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
3public PoC15.8%
1EPSS ≥ 0.55.3%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
19
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
19
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
4
21.1%
Forecast only
0
0.0%
No public exploit
15
78.9%
split by
peak 4 / year
20144
Not applicable4
Medium4
not blocked4
No public exploit4
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20160
20170
20182
Not applicable2
Medium2
not blocked2
No public exploit2
20191
Not applicable1
Medium1
not blocked1
No public exploit1
20201
Not applicable1
Medium1
not blocked1
No public exploit1
20213
Not applicable3
Medium3
not blocked3
No public exploit3
20222
Not applicable2
Medium2
not blocked2
Proof of concept only1
No public exploit1
20232
Not applicable2
Medium2
not blocked2
Proof of concept only1
No public exploit1
20240
20253
Not applicable3
Medium3
not blocked3
Proof of concept only2
No public exploit1
201420152016201720182019202020212022202320242025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-55183 | Medium | 2025-12-11 | Not applicable | Proof of concept only | An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. A specifically crafted HTTP request sent to a vulnerable Server Function may unsafely return the source code of any Server Function. Exploitation requires the existence of a Server Function which explicitly or implicitly exposes a stringified argument. |
| CVE-2025-55181 | Medium | 2025-12-02 | Not applicable | No public exploit | Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory. |
| CVE-2025-27591 | Medium | 2025-03-11 | Not applicable | Proof of concept only | A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This could have allowed local unprivileged users to escalate to root privileges through symlink attacks that manipulate files such as /etc/shadow. |
| CVE-2023-5654 | Medium | 2023-10-19 | Not applicable | Proof of concept only | The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim's browser. |
| CVE-2023-30792 | Medium | 2023-04-29 | Not applicable | No public exploit | Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources. |
| CVE-2020-20094 | Medium | 2022-03-23 | Not applicable | No public exploit | Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages |
| CVE-2020-20093 | Medium | 2022-03-23 | Not applicable | Proof of concept only | The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages. |
| CVE-2021-24033 | Medium | 2021-03-09 | Not applicable | No public exploit | react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you. |
| CVE-2021-24032 | Medium | 2021-03-04 | Not applicable | No public exploit | Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties. |
| CVE-2021-24031 | Medium | 2021-03-04 | Not applicable | No public exploit | In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties. |
| CVE-2016-1000109 | Medium | 2020-02-19 | Not applicable | No public exploit | HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. This issue affects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0 and 3.14.2 (inclusive). |
| CVE-2019-3554 | Medium | 2019-01-15 | Not applicable | No public exploit | Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems accepting such connections. This affects versions of Wangle prior to v2019.01.14.00 |
| CVE-2018-6341 | Medium | 2018-12-31 | Not applicable | No public exploit | React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2. |
| CVE-2018-6332 | Medium | 2018-12-03 | Not applicable | No public exploit | A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources. This affects all supported versions of HHVM (3.24.3 and 3.21.7 and below) when using the proxygen server to handle HTTP2 requests. |
| CVE-2014-9714 | Medium | 2015-04-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function. |
| CVE-2014-6229 | Medium | 2014-12-28 | Not applicable | No public exploit | The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string, and makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging truncation of a string containing an internal '\0' character. |
| CVE-2014-5386 | Medium | 2014-12-28 | Not applicable | No public exploit | The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initialization vector. |
| CVE-2014-2209 | Medium | 2014-12-28 | Not applicable | No public exploit | Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory. |
| CVE-2014-6392 | Medium | 2014-09-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. NOTE: the vendor disputes the significance of this report, because the user must accept an interstitial warning before the HTML file content is rendered, and because the HTML content's origin is a sandbox domain |