Overview 10 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
10matches
1in Waratek scope10.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
2public PoC20.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
10.0%
Outside Waratek scope
0
0.0%
Not applicable
9
90.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
10
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
2
20.0%
Proof of concept only
2
20.0%
Forecast only
0
0.0%
No public exploit
6
60.0%
split by
peak 3 / year
20171
Not applicable1
Medium1
not blocked1
No public exploit1
20180
20191
Not applicable1
Medium1
not blocked1
No public exploit1
20200
20211
No exploit published1
Medium1
not blocked1
No public exploit1
20223
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20230
20241
Not applicable1
Medium1
not blocked1
Working exploit published1
20253
Not applicable3
Medium3
not blocked3
Proof of concept only2
No public exploit1
201720182019202020212022202320242025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-29157 | Medium | 2025-09-25 | Not applicable | No public exploit | An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via accessing a non-existent endpoint/cart, the server returns a 404-error page exposing sensitive information including the Servlet name (default) and server version |
| CVE-2025-29156 | Medium | 2025-09-25 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/v3/pet |
| CVE-2025-29155 | Medium | 2025-09-25 | Not applicable | Proof of concept only | An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint |
| CVE-2024-22207 | Medium | 2024-01-15 | Not applicable | Working exploit published | fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability. |
| CVE-2021-46708 | Medium | 2022-03-11 | Not applicable | No public exploit | The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. |
| CVE-2018-25031 | Medium | 2022-03-11 | Not applicable | Working exploit published | Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others. |
| CVE-2021-41657 | Medium | 2022-03-10 | Not applicable | No public exploit | SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack. |
| CVE-2021-21364 | Medium | 2021-03-11 | No exploit published | No public exploit | swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix-Like systems, the system temporary directory is shared between all local users. When files/directories are created, the default `umask` settings for the process are respected. As a result, by default, most processes/apis will create files/directories with the permissions `-rw-r--r--` and `drwxr-xr-x` respectively, unless an API that explicitly sets safe file permissions is used. Because this vulnerability impacts generated code, the generated code will remain vulnerable until fixed manually! This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21363. |
| CVE-2016-1000229 | Medium | 2019-12-20 | Not applicable | No public exploit | swagger-ui has XSS in key names |
| CVE-2016-5682 | Medium | 2017-04-10 | Not applicable | No public exploit | Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section. |