WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor org.apache.tika✕
Overview 8 matches · 2 exploited · 0 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
8matches 2exploited25.0% 0CISA KEV0.0% 4public PoC50.0% 2EPSS ≥ 0.525.0%
Protected by Waratek 8 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 3 37.5% High 4 50.0% Medium 1 12.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 8 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 25.0% Working exploit published 1 12.5% Proof of concept only 1 12.5% Forecast only 0 0.0% No public exploit 4 50.0%
split by peak 4 / year
Protected by Waratek: 8 Medium: 1High: 4Critical: 3 blocked by ARMR today: 8 No public exploit: 4Proof of concept only: 1Working exploit published: 1Exploited: 2
20172 Protected by Waratek2 Critical1 High1 blocked by ARMR today2 No public exploit2 20184 Protected by Waratek4 High3 Medium1 blocked by ARMR today4 Exploited1 Proof of concept only1 No public exploit2 20190 20200 20210 20220 20230 20240 20252 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited1 Working exploit published1
201720182019202020212022202320242025
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-66516 Critical 2025-12-04 Protected by Waratek Working exploit published Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
CVE-2025-54988 Critical 2025-08-20 Protected by Waratek Exploited Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard. Users are recommended to upgrade to version 3.2.2, which fixes this issue.
CVE-2018-11796 High 2018-10-09 Protected by Waratek No public exploit In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
CVE-2018-11762 Medium 2018-09-19 Protected by Waratek No public exploit In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
CVE-2018-11761 High 2018-09-19 Protected by Waratek Proof of concept only In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
CVE-2018-1335 High 2018-04-25 Protected by Waratek Exploited From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
CVE-2016-4434 High 2017-09-30 Protected by Waratek No public exploit Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
CVE-2016-6809 Critical 2017-04-06 Protected by Waratek No public exploit Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.