CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2023-41266 KEV |
[KEV] Vulnerability in Qlik Sense (CVE-2023-41266)
Vulnerability in Qlik Sense (CVE-2023-41266). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22071 KEV |
[KEV] Use-After-Free in Qualcomm Multiple Chipsets (CVE-2022-22071)
Vulnerability in Qualcomm Multiple Chipsets (CVE-2022-22071). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-33063 KEV |
[KEV] Use-After-Free in Qualcomm Multiple Chipsets (CVE-2023-33063)
Vulnerability in Qualcomm Multiple Chipsets (CVE-2023-33063). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to SoCVersion:2023-12-05 or later.
|
|
| CVE-2023-33106 KEV |
[KEV] Vulnerability in Qualcomm Multiple Chipsets (CVE-2023-33106)
Vulnerability in Qualcomm Multiple Chipsets (CVE-2023-33106). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-33107 KEV |
[KEV] Vulnerability in Qualcomm Multiple Chipsets (CVE-2023-33107)
Vulnerability in Qualcomm Multiple Chipsets (CVE-2023-33107). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-42916 KEV |
[KEV] Out-of-Bounds Read in Apple Multiple Products (CVE-2023-42916)
Vulnerability in Apple Multiple Products (CVE-2023-42916). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-42917 KEV |
[KEV] Out-of-Bounds Write in Apple Multiple Products (CVE-2023-42917)
Out-of-bounds write in Apple Multiple Products (CVE-2023-42917). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.8.0, 8.0.411 or later.
|
|
| CVE-2023-49103 KEV |
[KEV] Vulnerability in ownCloud graphapi (CVE-2023-49103)
Vulnerability in ownCloud graphapi (CVE-2023-49103). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-6345 KEV |
[KEV] Vulnerability in Google Chromium Skia (CVE-2023-6345)
Vulnerability in Google Chromium Skia (CVE-2023-6345). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-4911 KEV |
[KEV] Vulnerability in GNU C Library (CVE-2023-4911)
Vulnerability in GNU C Library (CVE-2023-4911). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-2551 KEV |
[KEV] Vulnerability in Oracle Fusion Middleware (CVE-2020-2551)
Vulnerability in Oracle Fusion Middleware (CVE-2020-2551). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-1671 KEV |
[KEV] Command Injection in Sophos Web Appliance (CVE-2023-1671)
Command injection in Sophos Web Appliance (CVE-2023-1671). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36584 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-36584)
Vulnerability in Microsoft Windows (CVE-2023-36584). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36036 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-36036)
Vulnerability in Microsoft Windows (CVE-2023-36036). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36025 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-36025)
Vulnerability in Microsoft Windows (CVE-2023-36025). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36033 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2023-36033)
Vulnerability in Microsoft Windows (CVE-2023-36033). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36851 KEV |
[KEV] Vulnerability in Juniper Junos OS (CVE-2023-36851)
Vulnerability in Juniper Junos OS (CVE-2023-36851). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36847 KEV |
[KEV] Vulnerability in Juniper Junos OS (CVE-2023-36847)
Vulnerability in Juniper Junos OS (CVE-2023-36847). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36846 KEV |
[KEV] Vulnerability in Juniper Junos OS (CVE-2023-36846)
Vulnerability in Juniper Junos OS (CVE-2023-36846). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36845 KEV |
[KEV] Vulnerability in Juniper Junos OS (CVE-2023-36845)
Vulnerability in Juniper Junos OS (CVE-2023-36845). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-36844 KEV |
[KEV] Vulnerability in Juniper Junos OS (CVE-2023-36844)
Vulnerability in Juniper Junos OS (CVE-2023-36844). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-47246 KEV |
[KEV] Path Traversal in SysAid Server (CVE-2023-47246)
Path traversal in SysAid Server (CVE-2023-47246). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-29552 KEV |
[KEV] Vulnerability in IETF Service Location Protocol (SLP) (CVE-2023-29552)
Vulnerability in IETF Service Location Protocol (SLP) (CVE-2023-29552). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-22518 KEV |
[KEV] Authorization Flaw in Atlassian Confluence Data Center and Server (CVE-2023-22518)
Vulnerability in Atlassian Confluence Data Center and Server (CVE-2023-22518). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-46604 KEV |
[KEV] Unsafe Deserialization in Apache ActiveMQ (CVE-2023-46604)
Vulnerability in Apache ActiveMQ (CVE-2023-46604). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-46747 KEV |
[KEV] Vulnerability in F5 BIG-IP Configuration Utility (CVE-2023-46747)
Vulnerability in F5 BIG-IP Configuration Utility (CVE-2023-46747). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-46748 KEV |
[KEV] SQL Injection in F5 BIG-IP Configuration Utility (CVE-2023-46748)
SQL injection in F5 BIG-IP Configuration Utility (CVE-2023-46748). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-5631 KEV |
[KEV] Cross-Site Scripting (XSS) in Roundcube Webmail (CVE-2023-5631)
Cross-site scripting in Roundcube Webmail (CVE-2023-5631). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-20273 KEV |
[KEV] OS Command Injection in Cisco IOS XE Web UI (CVE-2023-20273)
OS command injection in Cisco IOS XE Web UI (CVE-2023-20273). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-4966 KEV |
[KEV] Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-4966)
Vulnerability in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-4966). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-20198 KEV |
[KEV] Vulnerability in Cisco IOS XE Web UI (CVE-2023-20198)
Vulnerability in Cisco IOS XE Web UI (CVE-2023-20198). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-44487 KEV |
[KEV] Vulnerability in IETF HTTP/2 (CVE-2023-44487)
Vulnerability in IETF HTTP/2 (CVE-2023-44487). Risk of unauthorized operations or information disclosure. Exploitable via Channel. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 0.17.0 or later.
|
|
| CVE-2023-36563 KEV |
[KEV] Vulnerability in Microsoft WordPad (CVE-2023-36563)
Vulnerability in Microsoft WordPad (CVE-2023-36563). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-41763 KEV |
[KEV] SSRF (Server-Side Request Forgery) in Microsoft Skype for Business (CVE-2023-41763)
SSRF in Microsoft Skype for Business (CVE-2023-41763). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-20109 KEV |
[KEV] Out-of-Bounds Write in Cisco IOS and IOS XE (CVE-2023-20109)
Out-of-bounds write in Cisco IOS and IOS XE (CVE-2023-20109). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-21608 KEV |
[KEV] Use-After-Free in Adobe Acrobat and Reader (CVE-2023-21608)
Vulnerability in Adobe Acrobat and Reader (CVE-2023-21608). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-42824 KEV |
[KEV] Vulnerability in Apple iOS and iPadOS (CVE-2023-42824)
Vulnerability in Apple iOS and iPadOS (CVE-2023-42824). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-40044 KEV |
[KEV] Unsafe Deserialization in Progress WS_FTP Server (CVE-2023-40044)
Vulnerability in Progress WS_FTP Server (CVE-2023-40044). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-22515 KEV |
[KEV] Vulnerability in Atlassian Confluence Data Center and Server (CVE-2023-22515)
Vulnerability in Atlassian Confluence Data Center and Server (CVE-2023-22515). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-28229 KEV |
[KEV] Vulnerability in Microsoft Windows CNG Key Isolation Service (CVE-2023-28229)
Vulnerability in Microsoft Windows CNG Key Isolation Service (CVE-2023-28229). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-42793 KEV |
[KEV] Vulnerability in JetBrains TeamCity (CVE-2023-42793)
Vulnerability in JetBrains TeamCity (CVE-2023-42793). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-4211 KEV |
[KEV] Use-After-Free in Arm Mali GPU Kernel Driver (CVE-2023-4211)
Vulnerability in Arm Mali GPU Kernel Driver (CVE-2023-4211). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to SoCVersion:2023-10-05 or later.
|
|
| CVE-2023-5217 KEV |
[KEV] Out-of-Bounds Write in Google Chromium libvpx (CVE-2023-5217)
Out-of-bounds write in Google Chromium libvpx (CVE-2023-5217). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 27.0.0-beta.8 or later.
|
|
| CVE-2018-14667 KEV |
[KEV] Code Injection in Red Hat JBoss RichFaces Framework (CVE-2018-14667)
Code injection in Red Hat JBoss RichFaces Framework (CVE-2018-14667). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-41993 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2023-41993)
Vulnerability in Apple Multiple Products (CVE-2023-41993). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 1.8.0, 8.0.411 or later.
|
|
| CVE-2023-41992 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2023-41992)
Vulnerability in Apple Multiple Products (CVE-2023-41992). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-41991 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2023-41991)
Vulnerability in Apple Multiple Products (CVE-2023-41991). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-41179 KEV |
[KEV] Vulnerability in Trend Micro Apex One and Worry-Free Business Security (CVE-2023-41179)
Vulnerability in Trend Micro Apex One and Worry-Free Business Security (CVE-2023-41179). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-28434 KEV |
[KEV] Privilege Escalation in MinIO (CVE-2023-28434)
Vulnerability in MinIO (CVE-2023-28434). Risk of unauthorized operations or information disclosure. Exploitable via PostPolicyBucket. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-3129 KEV |
[KEV] Vulnerability in Laravel Ignition (CVE-2021-3129)
Vulnerability in Laravel Ignition (CVE-2021-3129). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
