Week 1, 2024
1 January to 7 January 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 390CVEs publishedin the whole week
- 52CriticalCVSS 9.0 and above
- 116HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-7024
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
Google · Chrome
ExploitedHigh8.8 - CVE-2023-7101
Arbitrary Code Execution (ACE) Vulnerability
Douglas Wilson · Spreadsheet::ParseExcel
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2022-46839
WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Arbitrary File Upload
JS Help Desk · JS Help Desk – Best Help Desk & Support Plugin
Critical10.0 - CVE-2023-48419
An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in EoP
Google · Google Nest Mini
Critical10.0 - CVE-2023-48418
User Build misconfiguration resulting in local escalation of privilege
Google · Pixel Watch
Critical10.0 - CVE-2023-6339
Google Nest WiFi Pro root code-execution & user-data compromise
Google · Wifi Pro
Critical10.0 - CVE-2023-49442
Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request.
Product not named
Critical9.8 - CVE-2023-51784
Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager
Apache Software Foundation · Apache InLong
Critical9.8 - CVE-2024-22087
route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code execution.
Product not named
Critical9.8 - CVE-2024-22051
CommonMarker Integer Overflow Vulnerability
commonmarker
Critical9.8 - CVE-2024-21623
Arbitrary Expression Injection in github workflow leads to Command execution & leaking secrets
mehah · otclient
Critical9.8 - CVE-2024-22086
handle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code execution.
Product not named
Critical9.8