| CVE-2023-33106 Known exploited | High 8.4 | Use of Out-of-range Pointer Offset in Graphics Assigned by qualcomm | Dec 5, 2023 |
| CVE-2023-33063 Known exploited | High 7.8 | Use After Free in DSP Services Assigned by qualcomm | Dec 5, 2023 |
| CVE-2023-42917 Known exploited | High 8.8 | A memory corruption vulnerability was addressed with improved locking. Assigned by apple | Nov 30, 2023 |
| CVE-2023-42916 Known exploited | Medium 6.5 | An out-of-bounds read was addressed with improved input validation. Assigned by apple | Nov 30, 2023 |
| CVE-2023-6345 Known exploited | Critical 9.6 | Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. Assigned by Chrome | Nov 29, 2023 |
| CVE-2023-49105 Known exploited | Critical 9.8 | An issue was discovered in ownCloud owncloud/core before 10.13.1. Assigned by mitre | Nov 21, 2023 |
| CVE-2023-49103 Known exploited | Critical 10.0 | An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. Assigned by mitre | Nov 21, 2023 |
| CVE-2023-48365 Known exploited | Critical 9.6 | Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Assigned by mitre | Nov 15, 2023 |
| CVE-2023-36025 Known exploited | High 8.8 | Windows SmartScreen Security Feature Bypass Vulnerability Assigned by microsoft | Nov 14, 2023 |
| CVE-2023-36033 Known exploited | High 7.8 | Windows DWM Core Library Elevation of Privilege Vulnerability Assigned by microsoft | Nov 14, 2023 |
| CVE-2023-36036 Known exploited | High 7.8 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Assigned by microsoft | Nov 14, 2023 |
| CVE-2023-36424 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | Nov 14, 2023 |
| CVE-2023-47246 Known exploited | Critical 9.8 | In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023. Assigned by mitre | Nov 10, 2023 |
| CVE-2023-22518 Known exploited | Critical 10.0 | All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. Assigned by atlassian | Oct 31, 2023 |
| CVE-2023-46604 Known exploited | Critical 10.0 | Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack Assigned by apache | Oct 27, 2023 |
| CVE-2023-46748 Known exploited | High 8.8 | BIG-IP Configuration utility authenticated SQL injection vulnerability Assigned by f5 | Oct 26, 2023 |
| CVE-2023-46747 Known exploited | Critical 9.8 | BIG-IP Configuration utility unauthenticated remote code execution vulnerability Assigned by f5 | Oct 26, 2023 |
| CVE-2023-43208 Known exploited Healthcare | Critical 9.8 | NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Assigned by mitre | Oct 26, 2023 |
| CVE-2023-34048 Known exploited | Critical 9.8 | VMware vCenter Server Out-of-Bounds Write Vulnerability Assigned by vmware | Oct 25, 2023 |
| CVE-2023-20273 Known exploited | High 7.2 | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. Assigned by cisco | Oct 24, 2023 |
| CVE-2023-5631 Known exploited | Medium 6.1 | Stored XSS vulnerability in Roundcube Assigned by ESET | Oct 18, 2023 |
| CVE-2023-45727 Known exploited | High 7.5 | Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to… Assigned by jpcert | Oct 18, 2023 |
| CVE-2023-20198 Known exploited | Critical 10.0 | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. Assigned by cisco | Oct 16, 2023 |
| CVE-2023-36563 Known exploited | Medium 6.5 | Microsoft WordPad Information Disclosure Vulnerability Assigned by microsoft | Oct 10, 2023 |
| CVE-2023-36584 Known exploited | Medium 5.4 | Windows Mark of the Web Security Feature Bypass Vulnerability Assigned by microsoft | Oct 10, 2023 |
| CVE-2023-41763 Known exploited | Medium 5.3 | Skype for Business Elevation of Privilege Vulnerability Assigned by microsoft | Oct 10, 2023 |
| CVE-2023-4966 Known exploited | Critical 9.4 | Unauthenticated sensitive information disclosure Assigned by Citrix | Oct 10, 2023 |
| CVE-2023-44487 Known exploited | High 7.5 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Assigned by mitre | Oct 10, 2023 |
| CVE-2023-42824 Known exploited | High 7.8 | The issue was addressed with improved checks. Assigned by apple | Oct 4, 2023 |
| CVE-2023-22515 Known exploited | Critical 10.0 | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Cent… Assigned by atlassian | Oct 4, 2023 |
| CVE-2023-4911 Known exploited | High 7.8 | Glibc: buffer overflow in ld.so leading to privilege escalation Assigned by redhat | Oct 3, 2023 |
| CVE-2023-4211 Known exploited | Medium 5.5 | Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations Assigned by Arm | Oct 1, 2023 |
| CVE-2023-5217 Known exploited | High 8.8 | Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Sep 28, 2023 |
| CVE-2023-20109 Known exploited | Medium 6.6 | A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative contr… Assigned by cisco | Sep 27, 2023 |
| CVE-2023-40044 Known exploited | Critical 10.0 | WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability Assigned by ProgressSoftware | Sep 27, 2023 |
| CVE-2023-36851 Known exploited | Medium 5.3 | Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files Assigned by juniper | Sep 26, 2023 |
| CVE-2023-43770 Known exploited | Medium 6.1 | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. Assigned by mitre | Sep 22, 2023 |
| CVE-2023-41993 Known exploited | High 8.8 | The issue was addressed with improved checks. Assigned by apple | Sep 21, 2023 |
| CVE-2023-41992 Known exploited | High 7.8 | The issue was addressed with improved checks. Assigned by apple | Sep 21, 2023 |
| CVE-2023-41991 Known exploited | Medium 5.5 | A certificate validation issue was addressed. Assigned by apple | Sep 21, 2023 |
| CVE-2023-42793 Known exploited | Critical 9.8 | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible Assigned by JetBrains | Sep 19, 2023 |
| CVE-2023-41179 Known exploited | High 7.2 | A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an atta… Assigned by trendmicro | Sep 19, 2023 |
| CVE-2023-38205 Known exploited | High 7.5 | ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298 Assigned by adobe | Sep 14, 2023 |
| CVE-2023-26369 Known exploited | High 7.8 | [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild Assigned by adobe | Sep 13, 2023 |
| CVE-2023-36761 Known exploited | Medium 6.5 | Microsoft Word Information Disclosure Vulnerability Assigned by microsoft | Sep 12, 2023 |
| CVE-2023-36802 Known exploited | High 7.8 | Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability Assigned by microsoft | Sep 12, 2023 |
| CVE-2023-4863 Known exploited | High 8.8 | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Assigned by Chrome | Sep 12, 2023 |
| CVE-2023-41990 Known exploited | High 7.8 | The issue was addressed with improved handling of caches. Assigned by apple | Sep 11, 2023 |
| CVE-2023-35674 Known exploited | High 8.8 | In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. Assigned by google_android | Sep 11, 2023 |
| CVE-2023-39780 Known exploited | High 8.8 | On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. Assigned by mitre | Sep 11, 2023 |
