Week 48, 2023
27 November to 3 December 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 498CVEs publishedin the whole week
- 88CriticalCVSS 9.0 and above
- 146HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-49103
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php…
Product not named
ExploitedCritical10.0 - CVE-2023-6345
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a…
Google · Chrome
ExploitedCritical9.6
Most severe new CVEsBy CVSS score
- CVE-2023-48022
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is…
Product not named
Critical9.8 - CVE-2023-3368
Chamilo LMS Unauthenticated Command Injection
Chamilo · Chamilo
Critical9.8 - CVE-2023-6329
Control iD iDSecure passwordCustom Authentication Bypass
Control iD · iDSecure
Critical9.8 - CVE-2023-4473
A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could…
Zyxel · NAS326 firmware
Critical9.8 - CVE-2023-35138
A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware…
Zyxel · NAS326 firmware
Critical9.8 - CVE-2023-4474
The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version…
Zyxel · NAS326 firmware
Critical9.8 - CVE-2023-4922
WPB Show Core <= 2.2 - Unauthenticated Local File Inclusion
Unknown · wpb-show-core
Critical9.8 - CVE-2023-47207
Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data
Delta Electronics · InfraSuite Device Master
Critical9.8 - CVE-2023-41998
Arcserve UDP Unauthenticated RCE
Arcserve · Arcserve UDP
Critical9.8 - CVE-2023-49043
Buffer Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the wpapsk_crypto parameter in the function…
Product not named
Critical9.8