Cryostat records
12 published records for vendor cryostat.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 2
- With a fix record
- 91.7%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')2
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm2
- CWE-385 Covert Timing Channel1
- CWE-400 Uncontrolled Resource Consumption1
- CWE-732 Incorrect Permission Assignment for Critical Resource1
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
12 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
37Monitor | CVE-2025-14813No exploit | GOSTCTR implementation unable to process more than 255 blocks correctlylegion of the bouncy castle inc. · bc-java · CWE-327 | Critical9.3 | — | 0.3% | Apr 15, 2026 |
36Monitor | CVE-2026-9277Proof of concept | shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`CWE-77 | Critical9.2 | — | 0.7% | May 22, 2026 |
35Monitor | CVE-2026-5598No exploit | Non-constant time comparisons risk private key leakage in FrodoKEM.legion of the bouncy castle inc. · bc-java · CWE-385 | High8.9 | — | 0.8% | Apr 15, 2026 |
34Monitor | CVE-2026-12143No exploit | form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)form-data · form-data · CWE-93 | High8.7 | — | 0.6% | Jun 12, 2026 |
34Monitor | CVE-2026-46385No exploit | iskorotkov/avro: CPU Exhaustion in Avro Decoderiskorotkov · avro · CWE-400 | High8.7 | — | 0.6% | May 29, 2026 |
34Monitor | CVE-2026-46384No exploit | iskorotkov/avro: Integer Overflow in Avro Decoderiskorotkov · avro · CWE-190 | High8.7 | — | 0.5% | May 29, 2026 |
31Monitor | CVE-2026-44724No exploit | systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile namesebhildebrandt · systeminformation · CWE-78 | High7.8 | — | 0.9% | May 27, 2026 |
30Monitor | CVE-2024-52011Proof of concept | launch-editor vulnerable to command injection via the crafted request on Windowsvitejs · launch-editor · CWE-77 | High7.5 | — | 0.5% | Jun 1, 2026 |
28Monitor | CVE-2026-0775No exploit | npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerabilitynpm · cli · CWE-732 | High7.0 | — | 0.2% | Jan 23, 2026 |
25Monitor | CVE-2026-5588No exploit | PKIX draft CompositeVerifier accepts empty signature sequence as valid.legion of the bouncy castle inc. · bc-java · CWE-327 | Medium6.3 | — | 0.7% | Apr 15, 2026 |
22Monitor | CVE-2026-0636No exploit | LDAP Injection Vulnerability in LDAPStoreHelper.javalegion of the bouncy castle inc. · bc-java · CWE-90 | Medium5.5 | — | 0.5% | Apr 15, 2026 |
11Monitor | CVE-2025-69873No exploit | ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enaajv.js · ajv · CWE-1333 | Low2.9 | — | 0.5% | Feb 11, 2026 |
- CVE-2025-1481337Monitor
GOSTCTR implementation unable to process more than 255 blocks correctly
CriticalCVSS 9.3No exploitEPSS 0%legion of the bouncy castle inc. · bc-javaApr 15, 2026
- CVE-2026-927736Monitor
shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
CriticalCVSS 9.2Proof of conceptEPSS 0%May 22, 2026
- CVE-2026-559835Monitor
Non-constant time comparisons risk private key leakage in FrodoKEM.
HighCVSS 8.9No exploitEPSS 0%legion of the bouncy castle inc. · bc-javaApr 15, 2026
- CVE-2026-1214334Monitor
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
HighCVSS 8.7No exploitEPSS 0%form-data · form-dataJun 12, 2026
- CVE-2026-4638534Monitor
iskorotkov/avro: CPU Exhaustion in Avro Decoder
HighCVSS 8.7No exploitEPSS 0%iskorotkov · avroMay 29, 2026
- CVE-2026-4638434Monitor
iskorotkov/avro: Integer Overflow in Avro Decoder
HighCVSS 8.7No exploitEPSS 0%iskorotkov · avroMay 29, 2026
- CVE-2026-4472431Monitor
systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
HighCVSS 7.8No exploitEPSS 0%sebhildebrandt · systeminformationMay 27, 2026
- CVE-2024-5201130Monitor
launch-editor vulnerable to command injection via the crafted request on Windows
HighCVSS 7.5Proof of conceptEPSS 0%vitejs · launch-editorJun 1, 2026
- CVE-2026-077528Monitor
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability
HighCVSS 7.0No exploitEPSS 0%npm · cliJan 23, 2026
- CVE-2026-558825Monitor
PKIX draft CompositeVerifier accepts empty signature sequence as valid.
MediumCVSS 6.3No exploitEPSS 0%legion of the bouncy castle inc. · bc-javaApr 15, 2026
- CVE-2026-063622Monitor
LDAP Injection Vulnerability in LDAPStoreHelper.java
MediumCVSS 5.5No exploitEPSS 0%legion of the bouncy castle inc. · bc-javaApr 15, 2026
- CVE-2025-6987311Monitor
ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is ena
LowCVSS 2.9No exploitEPSS 0%ajv.js · ajvFeb 11, 2026