Week 17, 2023
24 April to 30 April 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 466CVEs publishedin the whole week
- 63CriticalCVSS 9.0 and above
- 147HighCVSS 7.0 to 8.9
- 0Added to KEVknown exploited, newly listed
Most severe new CVEsBy CVSS score
- CVE-2023-2356
Relative Path Traversal in mlflow/mlflow
mlflow · mlflow/mlflow
Critical10.0 - CVE-2023-1968
CVE-2023-1968
Illumina · iScan Control Software
Critical10.0 - CVE-2023-30839
PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"
PrestaShop · PrestaShop
Critical10.0 - CVE-2023-1778
Default Credential Vulnerability in GajShield Data Security Firewall
GajShield · Data Security Firewall
Critical10.0 - CVE-2023-28771
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series…
Zyxel · ZyWALL/USG series firmware
ExploitedCritical9.8 - CVE-2023-28769
The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could…
Zyxel · DX5401-B0 firmware
Critical9.8 - CVE-2023-1020
Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi
Unknown · Steveas WP Live Chat Shoutbox
Critical9.8 - CVE-2023-30404
Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd parameter in the…
Product not named
Critical9.8 - CVE-2023-29566
huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the…
Product not named
Critical9.8 - CVE-2023-27848
broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
Product not named
Critical9.8