Week 1, 2023
2 January to 8 January 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 478CVEs publishedin the whole week
- 28CriticalCVSS 9.0 and above
- 150HighCVSS 7.0 to 8.9
- 0Added to KEVknown exploited, newly listed
Most severe new CVEsBy CVSS score
- CVE-2022-43931
Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to…
Synology · VPN Plus Server
Critical10.0 - CVE-2022-44877
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell…
Product not named
ExploitedCritical9.8 - CVE-2022-47523
Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.
Product not named
Critical9.8 - CVE-2023-22463
KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token
KubeOperator · KubePi
Critical9.8 - CVE-2022-4049
WP User <= 7.0 - Unauthenticated SQLi
Unknown · WP User
Critical9.8 - CVE-2022-4059
Cryptocurrency Widgets Pack < 2.0 - Unauthenticated SQLi
Unknown · Cryptocurrency Widgets Pack
Critical9.8 - CVE-2022-38627
Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection…
Product not named
Critical9.8 - CVE-2022-4297
WP AutoComplete Search <= 1.0.4 - Unauthenticated SQLi
Unknown · WP AutoComplete Search
Critical9.8 - CVE-2022-39073
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to…
MF286R
Critical9.8 - CVE-2021-32824
Regular expression Denial of Service in MooTools
Apache · Dubbo
Critical9.8