Week 27, 2023
3 July to 9 July 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 471CVEs publishedin the whole week
- 57CriticalCVSS 9.0 and above
- 195HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2021-29256
. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation.…
Product not named
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2023-36460
Mastodon vulnerable to arbitrary file creation through media attachments
mastodon · mastodon
Critical10.0 - CVE-2021-32494
Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial…
radare2 · radare2
Critical10.0 - CVE-2021-32495
Radare2 has a use-after-free vulnerability in pyc parser's get_none_object function. Attacker can read freed memory afterwards. This will allow attackers to…
radare2 · radare2
Critical10.0 - CVE-2021-33796
In MuJS before version 1.1.2, a use-after-free flaw in the regexp source property access may cause denial of service.
MuJS · MuJS
Critical10.0 - CVE-2022-4361
Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The…
keycloak · keycloak
Critical10.0 - CVE-2023-3460
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
Unknown · Ultimate Member
Critical9.8 - CVE-2023-26258
Arcserve UDP through 9.0.6034 allows authentication bypass. The method getVersionInfo at WebServiceImpl/services/FlashServiceImpl leaks the AuthUUID token.…
Product not named
Critical9.8 - CVE-2023-35797
Apache Airflow Hive Provider Beeline RCE with Principal
Apache Software Foundation · Apache Airflow Apache Hive Provider
Critical9.8 - CVE-2022-46080
Nexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET.
Product not named
Critical9.8 - CVE-2023-37144
Tenda AC10 v15.03.06.26 was discovered to contain a command injection vulnerability via the mac parameter in the function formWriteFacMac.
Product not named
Critical9.8