CVE Intelligence
Home / CVEs

Exploited vulnerabilities (CISA KEV)

CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.

Severity
Clear

10 result(s)

Export this search: RSS · CSV · STIX
CVE-2023-23529 High · 8.8 KEV High · 55 CWE-843 Feb 27, 2023
Apple Multiple Products WebKit Type Confusion Vulnerability
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVE-2022-47986 Critical · 9.8 KEV Urgent · 91 Public exploit Ransomware CWE-502 Feb 17, 2023
IBM Aspera Faspex Code Execution Vulnerability
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
CVE-2023-23752 Medium · 5.3 KEV Urgent · 76 Public exploit CWE-284 Feb 16, 2023
Joomla! Improper Access Control Vulnerability
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
CVE-2023-21823 High · 7.8 KEV High · 61 Public exploit CWE-190 Feb 14, 2023
Microsoft Windows Graphic Component Privilege Escalation Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability
CVE-2023-23376 High · 7.8 KEV High · 65 Ransomware CWE-787 Feb 14, 2023
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2023-21715 High · 7.3 KEV High · 55 CWE-863 Feb 14, 2023
Microsoft Office Publisher Security Feature Bypass Vulnerability
Microsoft Publisher Security Feature Bypass Vulnerability
CVE-2023-21529 High · 8.8 KEV High · 66 Ransomware CWE-502 Feb 14, 2023
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-25717 Critical · 9.8 KEV High · 67 Public exploit CWE-94 Feb 13, 2023
Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.
CVE-2022-24990 High · 7.5 KEV Urgent · 89 Public exploit Ransomware CWE-306 Feb 7, 2023
TerraMaster OS Remote Command Execution Vulnerability
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
CVE-2023-0669 High · 7.2 KEV Urgent · 86 Public exploit Ransomware CWE-502 Feb 6, 2023
Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.