Week 12, 2023
20 March to 26 March 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 591CVEs publishedin the whole week
- 60CriticalCVSS 9.0 and above
- 203HighCVSS 7.0 to 8.9
- 0Added to KEVknown exploited, newly listed
Most severe new CVEsBy CVSS score
- CVE-2023-28445
Deno improperly handles resizable ArrayBuffer
denoland · deno
Critical10.0 - CVE-2023-27874
IBM Aspera Faspex XML external entity injection
IBM · Aspera Faspex
Critical9.9 - CVE-2023-28444
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend
kyubisation · angular-server-side-configuration
Critical9.9 - CVE-2023-27586
CairoSVG improperly processes SVG files loaded from external resources
Kozea · CairoSVG
Critical9.9 - CVE-2023-26359
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
Adobe · ColdFusion
ExploitedCritical9.8 - CVE-2022-42948
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely…
Product not named
ExploitedCritical9.8 - CVE-2023-26801
LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection…
Product not named
Critical9.8 - CVE-2023-27034
PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.
Product not named
Critical9.8 - CVE-2023-26802
An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and…
Product not named
Critical9.8 - CVE-2023-28662
The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template…
Gift Cards (Gift Vouchers and Packages) WordPress Plugin
Critical9.8