| CVE-2023-32315 Known exploited | High 8.6 | Openfire administration console authentication bypass Assigned by GitHub_M | May 26, 2023 |
| CVE-2023-2868 Known exploited | Critical 9.4 | Remote Code injection in Barracuda Email Security Gateway Assigned by Google | May 24, 2023 |
| CVE-2023-33246 Known exploited | Critical 9.8 | Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function Assigned by apache | May 24, 2023 |
| CVE-2023-33010 Known exploited | Critical 9.8 | A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50… Assigned by Zyxel | May 24, 2023 |
| CVE-2023-33009 Known exploited | Critical 9.8 | A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(… Assigned by Zyxel | May 24, 2023 |
| CVE-2023-29336 Known exploited | High 7.8 | Win32k Elevation of Privilege Vulnerability Assigned by microsoft | May 9, 2023 |
| CVE-2023-24955 Known exploited | High 7.2 | Microsoft SharePoint Server Remote Code Execution Vulnerability Assigned by microsoft | May 9, 2023 |
| CVE-2023-21492 Known exploited | Medium 4.4 | Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. Assigned by Samsung Mobile | May 4, 2023 |
| CVE-2023-29552 Known exploited | High 7.5 | The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. Assigned by mitre | Apr 25, 2023 |
| CVE-2023-28771 Known exploited | Critical 9.8 | Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, an… Assigned by Zyxel | Apr 25, 2023 |
| CVE-2023-27524 Known exploited | High 8.9 | Apache Superset: Session validation vulnerability when using provided default SECRET_KEY Assigned by apache | Apr 24, 2023 |
| CVE-2023-27351 Known exploited | High 8.2 | This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Assigned by zdi | Apr 20, 2023 |
| CVE-2023-27350 Known exploited | Critical 9.8 | This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Assigned by zdi | Apr 20, 2023 |
| CVE-2023-2136 Known exploited | Critical 9.6 | Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Assigned by Chrome | Apr 19, 2023 |
| CVE-2023-22894 Known exploited | High 7.2 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. Assigned by mitre | Apr 19, 2023 |
| CVE-2023-2033 Known exploited | High 8.8 | Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Apr 14, 2023 |
| CVE-2023-28252 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | Apr 11, 2023 |
| CVE-2023-28229 Known exploited | High 7.0 | Windows CNG Key Isolation Service Elevation of Privilege Vulnerability Assigned by microsoft | Apr 11, 2023 |
| CVE-2023-29492 Known exploited | Critical 9.8 | Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. Assigned by mitre | Apr 11, 2023 |
| CVE-2023-28206 Known exploited | High 8.6 | An out-of-bounds write issue was addressed with improved input validation. Assigned by apple | Apr 10, 2023 |
| CVE-2023-28205 Known exploited | High 8.8 | A use after free issue was addressed with improved memory management. Assigned by apple | Apr 10, 2023 |
| CVE-2023-26083 Known exploited | Low 3.3 | Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver al… Assigned by mitre | Apr 6, 2023 |
| CVE-2023-20118 Known exploited | Medium 6.5 | A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute ar… Assigned by cisco | Apr 5, 2023 |
| CVE-2023-1671 Known exploited | Critical 9.8 | A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code. Assigned by Sophos | Apr 4, 2023 |
| CVE-2022-43939 Known exploited | High 8.6 | Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions Assigned by HITVAN | Apr 3, 2023 |
| CVE-2022-43769 Known exploited | High 8.8 | Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) Assigned by HITVAN | Apr 3, 2023 |
| CVE-2023-20963 Known exploited | High 7.8 | In WorkSource, there is a possible parcel mismatch. Assigned by google_android | Mar 24, 2023 |
| CVE-2022-42948 Known exploited | Critical 9.8 | Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. Assigned by mitre | Mar 24, 2023 |
| CVE-2023-26360 Known exploited | High 8.6 | Adobe ColdFusion Improper Access Control Arbitrary code execution Assigned by adobe | Mar 23, 2023 |
| CVE-2023-26359 Known exploited | Critical 9.8 | Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution Assigned by adobe | Mar 23, 2023 |
| CVE-2023-28434 Known exploited | High 8.8 | MinIO is vulnerable to privilege escalation on Linux/MacOS Assigned by GitHub_M | Mar 22, 2023 |
| CVE-2023-28432 Known exploited | High 7.5 | Minio Information Disclosure in Cluster Deployment Assigned by GitHub_M | Mar 22, 2023 |
| CVE-2023-0386 Known exploited | High 7.8 | A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capabl… Assigned by redhat | Mar 22, 2023 |
| CVE-2023-25280 Known exploited | Critical 9.8 | OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp. Assigned by mitre | Mar 16, 2023 |
| CVE-2023-28461 Known exploited | Critical 9.8 | Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. Assigned by mitre | Mar 15, 2023 |
| CVE-2023-1389 Known exploited | High 8.8 | TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web manage… Assigned by tenable | Mar 15, 2023 |
| CVE-2023-24880 Known exploited | Medium 4.4 | Windows SmartScreen Security Feature Bypass Vulnerability Assigned by microsoft | Mar 14, 2023 |
| CVE-2023-23397 Known exploited | Critical 9.8 | Microsoft Outlook Elevation of Privilege Vulnerability Assigned by microsoft | Mar 14, 2023 |
| CVE-2023-27532 Known exploited | High 7.5 | Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. Assigned by hackerone | Mar 10, 2023 |
| CVE-2022-41328 Known exploited | Medium 6.5 | A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a… Assigned by fortinet | Mar 7, 2023 |
| CVE-2019-8720 Known exploited | High 8.8 | A vulnerability was found in WebKit. Assigned by redhat | Mar 6, 2023 |
| CVE-2023-23529 Known exploited | High 8.8 | A type confusion issue was addressed with improved checks. Assigned by apple | Feb 27, 2023 |
| CVE-2022-47986 Known exploited | Critical 9.8 | IBM Aspera Faspex code execution Assigned by ibm | Feb 17, 2023 |
| CVE-2023-23752 Known exploited | Medium 5.3 | [20230201] - Core - Improper access check in webservice endpoints Assigned by Joomla | Feb 16, 2023 |
| CVE-2023-21823 Known exploited | High 7.8 | Windows Graphics Component Remote Code Execution Vulnerability Assigned by microsoft | Feb 14, 2023 |
| CVE-2023-23376 Known exploited | High 7.8 | Windows Common Log File System Driver Elevation of Privilege Vulnerability Assigned by microsoft | Feb 14, 2023 |
| CVE-2023-21715 Known exploited | High 7.3 | Microsoft Publisher Security Feature Bypass Vulnerability Assigned by microsoft | Feb 14, 2023 |
| CVE-2023-21529 Known exploited | High 8.8 | Microsoft Exchange Server Remote Code Execution Vulnerability Assigned by microsoft | Feb 14, 2023 |
| CVE-2023-25717 Known exploited | Critical 9.8 | Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring. Assigned by mitre | Feb 13, 2023 |
| CVE-2022-24990 Known exploited | Critical 9.8 | TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in t… Assigned by mitre | Feb 7, 2023 |
