| CVE-2023-4863 Known exploited | High 8.8 | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Assigned by Chrome | Sep 12, 2023 |
| CVE-2023-36802 Known exploited | High 7.8 | Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability Assigned by microsoft | Sep 12, 2023 |
| CVE-2023-36761 Known exploited | Medium 6.5 | Microsoft Word Information Disclosure Vulnerability Assigned by microsoft | Sep 12, 2023 |
| CVE-2023-26369 Known exploited | High 7.8 | [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild Assigned by adobe | Sep 13, 2023 |
| CVE-2023-38205 Known exploited | High 7.5 | ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298 Assigned by adobe | Sep 14, 2023 |
| CVE-2023-41179 Known exploited | High 7.2 | A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an atta… Assigned by trendmicro | Sep 19, 2023 |
| CVE-2023-42793 Known exploited | Critical 9.8 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible Assigned by JetBrains | Sep 19, 2023 |
| CVE-2023-41991 Known exploited | Medium 5.5 | A certificate validation issue was addressed. Assigned by apple | Sep 21, 2023 |
| CVE-2023-41992 Known exploited | High 7.8 | The issue was addressed with improved checks. Assigned by apple | Sep 21, 2023 |
| CVE-2023-41993 Known exploited | High 8.8 | The issue was addressed with improved checks. Assigned by apple | Sep 21, 2023 |
| CVE-2023-43770 Known exploited | Medium 6.1 | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. Assigned by mitre | Sep 22, 2023 |
| CVE-2023-36851 Known exploited | Medium 5.3 | Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files Assigned by juniper | Sep 26, 2023 |
| CVE-2023-40044 Known exploited | Critical 10.0 | WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability Assigned by ProgressSoftware | Sep 27, 2023 |
| CVE-2023-20109 Known exploited | Medium 6.6 | A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative contr… Assigned by cisco | Sep 27, 2023 |
| CVE-2023-5217 Known exploited | High 8.8 | Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Sep 28, 2023 |
| CVE-2023-4211 Known exploited | Medium 5.5 | Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations Assigned by Arm | Oct 1, 2023 |
| CVE-2023-4911 Known exploited | High 7.8 | Glibc: buffer overflow in ld.so leading to privilege escalation Assigned by redhat | Oct 3, 2023 |
| CVE-2023-22515 Known exploited | Critical 10.0 | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Cent… Assigned by atlassian | Oct 4, 2023 |
| CVE-2023-42824 Known exploited | High 7.8 | The issue was addressed with improved checks. Assigned by apple | Oct 4, 2023 |
| CVE-2023-44487 Known exploited | High 7.5 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Assigned by mitre | Oct 10, 2023 |
| CVE-2023-4966 Known exploited | Critical 9.4 | Unauthenticated sensitive information disclosure Assigned by Citrix | Oct 10, 2023 |
| CVE-2023-41763 Known exploited | Medium 5.3 | Skype for Business Elevation of Privilege Vulnerability Assigned by microsoft | Oct 10, 2023 |
| CVE-2023-36584 Known exploited | Medium 5.4 | Windows Mark of the Web Security Feature Bypass Vulnerability Assigned by microsoft | Oct 10, 2023 |
| CVE-2023-36563 Known exploited | Medium 6.5 | Microsoft WordPad Information Disclosure Vulnerability Assigned by microsoft | Oct 10, 2023 |
| CVE-2023-20198 Known exploited | Critical 10.0 | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. Assigned by cisco | Oct 16, 2023 |
| CVE-2023-45727 Known exploited | High 7.5 | Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to… Assigned by jpcert | Oct 18, 2023 |
| CVE-2023-5631 Known exploited | Medium 6.1 | Stored XSS vulnerability in Roundcube Assigned by ESET | Oct 18, 2023 |
| CVE-2023-20273 Known exploited | High 7.2 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. Assigned by cisco | Oct 24, 2023 |
| CVE-2023-34048 Known exploited | Critical 9.8 | VMware vCenter Server Out-of-Bounds Write Vulnerability Assigned by vmware | Oct 25, 2023 |
| CVE-2023-43208 Known exploited Healthcare | Critical 9.8 | NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Assigned by mitre | Oct 26, 2023 |
| CVE-2023-46747 Known exploited | Critical 9.8 | BIG-IP Configuration utility unauthenticated remote code execution vulnerability Assigned by f5 | Oct 26, 2023 |
| CVE-2023-46748 Known exploited | High 8.8 | BIG-IP Configuration utility authenticated SQL injection vulnerability Assigned by f5 | Oct 26, 2023 |
| CVE-2023-46604 Known exploited | Critical 10.0 | Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack Assigned by apache | Oct 27, 2023 |
| CVE-2023-22518 Known exploited | Critical 10.0 | All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Assigned by atlassian | Oct 31, 2023 |
| CVE-2023-47246 Known exploited | Critical 9.8 | In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023. Assigned by mitre | Nov 10, 2023 |
| CVE-2023-36424 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | Nov 14, 2023 |
| CVE-2023-36036 Known exploited | High 7.8 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Assigned by microsoft | Nov 14, 2023 |
| CVE-2023-36033 Known exploited | High 7.8 | Windows DWM Core Library Elevation of Privilege Vulnerability Assigned by microsoft | Nov 14, 2023 |
| CVE-2023-36025 Known exploited | High 8.8 | Windows SmartScreen Security Feature Bypass Vulnerability Assigned by microsoft | Nov 14, 2023 |
| CVE-2023-48365 Known exploited | Critical 9.6 | Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Assigned by mitre | Nov 15, 2023 |
| CVE-2023-49105 Known exploited | Critical 9.8 | An issue was discovered in ownCloud owncloud/core before 10.13.1. Assigned by mitre | Nov 21, 2023 |
| CVE-2023-49103 Known exploited | Critical 10.0 | An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. Assigned by mitre | Nov 21, 2023 |
| CVE-2023-6345 Known exploited | Critical 9.6 | Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. Assigned by Chrome | Nov 29, 2023 |
| CVE-2023-42916 Known exploited | Medium 6.5 | An out-of-bounds read was addressed with improved input validation. Assigned by apple | Nov 30, 2023 |
| CVE-2023-42917 Known exploited | High 8.8 | A memory corruption vulnerability was addressed with improved locking. Assigned by apple | Nov 30, 2023 |
| CVE-2023-33063 Known exploited | High 7.8 | Use After Free in DSP Services Assigned by qualcomm | Dec 5, 2023 |
| CVE-2023-33106 Known exploited | High 8.4 | Use of Out-of-range Pointer Offset in Graphics Assigned by qualcomm | Dec 5, 2023 |
| CVE-2023-33107 Known exploited | High 8.4 | Integer Overflow or Wraparound in Graphics Linux Assigned by qualcomm | Dec 5, 2023 |
| CVE-2023-6448 Known exploited | Critical 9.8 | Unitronics VisiLogic uses a default administrative password Assigned by cisa-cg | Dec 5, 2023 |
| CVE-2023-44221 Known exploited | High 7.2 | Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody'… Assigned by sonicwall | Dec 5, 2023 |
