WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor org.apache.hugegraph✕
Overview 5 matches · 2 protected · 1 exploited · 1 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
5matches 2protected40.0% 1exploited20.0% 1CISA KEV20.0% 2public PoC40.0% 2EPSS ≥ 0.540.0%
Protected by Waratek 2 40.0% Rule in development 0 0.0% Mitigation candidate 1 20.0% No exploit published 2 40.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 3 60.0% High 1 20.0% Medium 1 20.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 40.0% partly blocked 0 0.0% not blocked 3 60.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 20.0% Working exploit published 1 20.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 60.0%
split by peak 3 / quarter
No exploit published: 2Mitigation candidate: 1Protected by Waratek: 2 Medium: 1High: 1Critical: 3 not blocked: 3blocked by ARMR today: 2 No public exploit: 3Working exploit published: 1Exploited: 1
Q2 243 Protected by Waratek1 No exploit published2 Critical2 Medium1 blocked by ARMR today1 not blocked2 Exploited1 No public exploit2 Q3 240 Q4 241 Mitigation candidate1 Critical1 not blocked1 Working exploit published1 Q1 250 Q2 250 Q3 250 Q4 251 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-26866 High 2025-12-12 Protected by Waratek No public exploit A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks. Users are recommended to upgrade to version 1.7.0, which fixes the issue.
CVE-2024-43441 Critical 2024-12-24 Mitigation candidate Working exploit published Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.
CVE-2024-27349 Critical 2024-04-22 No exploit published No public exploit Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.
CVE-2024-27348 Critical 2024-04-22 Protected by Waratek Exploited RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
CVE-2024-27347 Medium 2024-04-22 No exploit published No public exploit Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.