Home / CVEs
Exploited vulnerabilities (CISA KEV)
CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.
CVE-2023-7101
High · 7.8
KEV High · 68 Public exploit CWE-94 Dec 24, 2023
Spreadsheet::ParseExcel Remote Code Execution Vulnerability
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
CVE-2023-7024
High · 8.8
KEV High · 61 Public exploit CWE-787 Dec 21, 2023
Google Chromium WebRTC Heap Buffer Overflow Vulnerability
Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-47565
High · 8.8
KEV High · 56 CWE-78 Dec 8, 2023
QNAP VioStor NVR OS Command Injection Vulnerability
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated users to execute commands via a network.
We have already fixed the vulnerability in the following versions:
QVR Firmware 5.0.0 and later
CVE-2023-49897
High · 8.8
KEV High · 56 CWE-78 Dec 6, 2023
FXC AE1021, AE1021PE OS Command Injection Vulnerability
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
CVE-2023-44221
High · 7.2
KEV High · 56 CWE-78 Dec 5, 2023
SonicWall SMA100 Appliances OS Command Injection Vulnerability
Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user, potentially leading to OS Command Injection Vulnerability.
CVE-2023-6448
Critical · 9.8
KEV High · 60 CWE-798 Dec 5, 2023
Unitronics Vision PLC and HMI Insecure Default Password Vulnerability
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.
CVE-2023-33106
High · 7.8
KEV High · 49 CWE-119 Dec 5, 2023
Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
CVE-2023-33107
High · 7.8
KEV High · 55 Public exploit CWE-190 Dec 5, 2023
Qualcomm Multiple Chipsets Integer Overflow Vulnerability
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
CVE-2023-33063
High · 7.8
KEV High · 49 CWE-416 Dec 5, 2023
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Memory corruption in DSP Services during a remote call from HLOS to DSP.