Exploited vulnerabilities (CISA KEV)

CVE-2024-4577 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-78 Jun 9, 2024

PHP-CGI OS Command Injection Vulnerability

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

CVE-2024-5274 Critical · 9.6 KEV High · 65 Public exploit CWE-843 May 28, 2024

Google Chromium V8 Type Confusion Vulnerability

Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2024-4947 Critical · 9.6 KEV High · 66 Public exploit CWE-843 May 15, 2024

Google Chromium V8 Type Confusion Vulnerability

Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2024-4761 High · 8.8 KEV High · 61 Public exploit CWE-787 May 14, 2024

Google Chromium V8 Out-of-Bounds Memory Write Vulnerability

Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

CVE-2024-4671 Critical · 9.6 KEV High · 59 CWE-416 May 14, 2024

Google Chromium Visuals Use-After-Free Vulnerability

Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2024-1086 High · 7.8 KEV Urgent · 72 Public exploit Ransomware CWE-416 Jan 31, 2024

Linux Kernel Use-After-Free Vulnerability

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVE-2024-0519 High · 8.8 KEV High · 60 Public exploit CWE-787 Jan 16, 2024

Google Chromium V8 Out-of-Bounds Memory Access Vulnerability

Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-7101 High · 7.8 KEV High · 68 Public exploit CWE-94 Dec 24, 2023

Spreadsheet::ParseExcel Remote Code Execution Vulnerability

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

CVE-2023-7024 High · 8.8 KEV High · 61 Public exploit CWE-787 Dec 21, 2023

Google Chromium WebRTC Heap Buffer Overflow Vulnerability

Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-42916 Medium · 6.5 KEV High · 53 CWE-125 Nov 30, 2023

Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

CVE-2023-42917 High · 8.8 KEV High · 55 CWE-787 Nov 30, 2023

Apple Multiple Products WebKit Memory Corruption Vulnerability

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

CVE-2023-6345 Critical · 9.6 KEV High · 63 CWE-190 Nov 29, 2023

Google Skia Integer Overflow Vulnerability

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

CVE-2023-5631 Medium · 5.4 KEV High · 53 CWE-79 Oct 18, 2023

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

CVE-2023-44487 High · 7.5 KEV Urgent · 73 Public exploit CWE-400 Oct 10, 2023

HTTP/2 Rapid Reset Attack Vulnerability

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2023-4911 High · 7.8 KEV Urgent · 76 Public exploit CWE-787 Oct 3, 2023

GNU C Library Buffer Overflow Vulnerability

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

CVE-2023-5217 High · 8.8 KEV High · 62 Public exploit CWE-787 Sep 28, 2023

Google Chromium libvpx Heap Buffer Overflow Vulnerability

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-41993 High · 8.8 KEV High · 62 Public exploit CWE-754 Sep 21, 2023

Apple Multiple Products WebKit Code Execution Vulnerability

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

CVE-2023-4863 High · 8.8 KEV High · 62 Public exploit CWE-787 Sep 12, 2023

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

CVE-2023-4762 High · 8.8 KEV High · 62 Public exploit CWE-843 Sep 5, 2023

Google Chromium V8 Type Confusion Vulnerability

Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2023-38180 High · 7.5 KEV High · 58 CWE-400 Aug 8, 2023

Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

CVE-2023-20867 Low · 3.9 KEV High · 59 CWE-287 Jun 13, 2023

VMware Tools Authentication Bypass Vulnerability

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

CVE-2023-3079 High · 8.8 KEV High · 62 Public exploit CWE-843 Jun 5, 2023

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-2136 Critical · 9.6 KEV High · 59 CWE-190 Apr 19, 2023

Google Chrome Skia Integer Overflow Vulnerability

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2023-2033 High · 8.8 KEV High · 62 Public exploit CWE-843 Apr 14, 2023

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2022-3075 Critical · 9.6 KEV High · 59 CWE-20 Sep 26, 2022

Google Chromium Mojo Insufficient Data Validation Vulnerability

Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.