KEV / Archive / 2023
KEV additions in 2023
Every vulnerability CISA added to the Known Exploited Vulnerabilities catalog in 2023, with monthly counts, vendors and weaknesses.
Answer CISA added 187 vulnerabilities to the KEV catalog in 2023. The busiest month was June 2023, with 24. 43 were flagged as used by ransomware (23%), and the most-listed vendor was Microsoft with 27.
- Added
- 187in 2023
- Ransomware: known
- 23%43 entries
- Vendors
- 67distinct
- Median days to due
- 21dateAdded to dueDate
- Share of catalog
- 10.9%of 1,721
MAdditions per month
Table view
| Month | Added |
|---|---|
| Jan 23 | 5 |
| Feb 23 | 14 |
| Mar 23 | 18 |
| Apr 23 | 17 |
| May 23 | 19 |
| Jun 23 | 24 |
| Jul 23 | 16 |
| Aug 23 | 8 |
| Sep 23 | 19 |
| Oct 23 | 18 |
| Nov 23 | 18 |
| Dec 23 | 11 |
VTop vendors in 2023
WTop weaknesses in 2023
| CWE | Entries | Share of year |
|---|---|---|
| CWE-416 Use after free | 16 | 8.6% |
| CWE-78 OS command injection | 14 | 7.5% |
| CWE-20 Improper input validation | 11 | 5.9% |
| CWE-787 Out-of-bounds write | 9 | 4.8% |
| CWE-94 Code injection | 9 | 4.8% |
| CWE-502 Unsafe deserialization | 8 | 4.3% |
| CWE-122 Heap-based buffer overflow | 6 | 3.2% |
| CWE-306 Missing authentication | 6 | 3.2% |
EAll 187 entries added in 2023
| CVE | Vendor | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|---|
| CVE-2023-49897 | FXC | AE1021, AE1021PE | FXC AE1021, AE1021PE OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2023-47565 | QNAP | VioStor NVR | QNAP VioStor NVR OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2023-6448 | Unitronics | Vision PLC and HMI | Unitronics Vision PLC and HMI Insecure Default Password Vulnerability | Unknown | CWE-1188 | ||
| CVE-2023-41266 | Qlik | Sense | Qlik Sense Path Traversal Vulnerability | Known | CWE-20 | ||
| CVE-2023-41265 | Qlik | Sense | Qlik Sense HTTP Tunneling Vulnerability | Known | CWE-444 | ||
| CVE-2023-33107 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Integer Overflow Vulnerability | Unknown | CWE-190 | ||
| CVE-2023-33106 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability | Unknown | CWE-823 | ||
| CVE-2023-33063 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2022-22071 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-42917 | Apple | Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-42916 | Apple | Multiple Products | Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability | Unknown | CWE-125 | ||
| CVE-2023-6345 | Chromium Skia | Google Skia Integer Overflow Vulnerability | Unknown | CWE-190 | |||
| CVE-2023-49103 | ownCloud | ownCloud graphapi | ownCloud graphapi Information Disclosure Vulnerability | Unknown | none listed | ||
| CVE-2023-4911 | GNU | GNU C Library | GNU C Library Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2023-36584 | Microsoft | Windows | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | Unknown | none listed | ||
| CVE-2023-1671 | Sophos | Web Appliance | Sophos Web Appliance Command Injection Vulnerability | Unknown | CWE-77 | ||
| CVE-2020-2551 | Oracle | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | Unknown | none listed | ||
| CVE-2023-36036 | Microsoft | Windows | Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability | Unknown | CWE-122 | ||
| CVE-2023-36033 | Microsoft | Windows | Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | Unknown | CWE-822 | ||
| CVE-2023-36025 | Microsoft | Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | Unknown | none listed | ||
| CVE-2023-47246 | SysAid | SysAid Server | SysAid Server Path Traversal Vulnerability | Known | CWE-22 | ||
| CVE-2023-36851 | Juniper | Junos OS | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | Unknown | CWE-306 | ||
| CVE-2023-36847 | Juniper | Junos OS | Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability | Unknown | CWE-306 | ||
| CVE-2023-36846 | Juniper | Junos OS | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | Unknown | CWE-306 | ||
| CVE-2023-36845 | Juniper | Junos OS | Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability | Unknown | CWE-473 | ||
| CVE-2023-36844 | Juniper | Junos OS | Juniper Junos OS EX Series PHP External Variable Modification Vulnerability | Unknown | CWE-473 | ||
| CVE-2023-29552 | IETF | Service Location Protocol (SLP) | Service Location Protocol (SLP) Denial-of-Service Vulnerability | Unknown | none listed | ||
| CVE-2023-22518 | Atlassian | Confluence Data Center and Server | Atlassian Confluence Data Center and Server Improper Authorization Vulnerability | Known | CWE-863 | ||
| CVE-2023-46604 | Apache | ActiveMQ | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2023-46748 | F5 | BIG-IP Configuration Utility | F5 BIG-IP Configuration Utility SQL Injection Vulnerability | Unknown | CWE-89 | ||
| CVE-2023-46747 | F5 | BIG-IP Configuration Utility | F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability | Known | CWE-288 | ||
| CVE-2023-5631 | Roundcube | Webmail | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2023-20273 | Cisco | Cisco IOS XE Web UI | Cisco IOS XE Web UI Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2023-4966 | Citrix | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | Known | CWE-119 | ||
| CVE-2023-20198 | Cisco | IOS XE Web UI | Cisco IOS XE Web UI Privilege Escalation Vulnerability | Unknown | CWE-420 | ||
| CVE-2023-44487 | IETF | HTTP/2 | HTTP/2 Rapid Reset Attack Vulnerability | Unknown | CWE-400 | ||
| CVE-2023-41763 | Microsoft | Skype for Business | Microsoft Skype for Business Privilege Escalation Vulnerability | Unknown | CWE-918 | ||
| CVE-2023-36563 | Microsoft | WordPad | Microsoft WordPad Information Disclosure Vulnerability | Unknown | CWE-20 | ||
| CVE-2023-21608 | Adobe | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-20109 | Cisco | IOS and IOS XE | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-42824 | Apple | iOS and iPadOS | Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2023-40044 | Progress | WS_FTP Server | Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2023-22515 | Atlassian | Confluence Data Center and Server | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | Known | none listed | ||
| CVE-2023-42793 | JetBrains | TeamCity | JetBrains TeamCity Authentication Bypass Vulnerability | Known | CWE-288 | ||
| CVE-2023-28229 | Microsoft | Windows CNG Key Isolation Service | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | Unknown | CWE-591 | ||
| CVE-2023-4211 | Arm | Mali GPU Kernel Driver | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-5217 | Chromium libvpx | Google Chromium libvpx Heap Buffer Overflow Vulnerability | Unknown | CWE-787 | |||
| CVE-2018-14667 | Red Hat | JBoss RichFaces Framework | Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability | Unknown | CWE-94 | ||
| CVE-2023-41993 | Apple | Multiple Products | Apple Multiple Products WebKit Code Execution Vulnerability | Unknown | CWE-754 | ||
| CVE-2023-41992 | Apple | Multiple Products | Apple Multiple Products Kernel Privilege Escalation Vulnerability | Unknown | CWE-754 | ||
| CVE-2023-41991 | Apple | Multiple Products | Apple Multiple Products Improper Certificate Validation Vulnerability | Unknown | CWE-295 | ||
| CVE-2023-41179 | Trend Micro | Apex One and Worry-Free Business Security | Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2023-28434 | MinIO | MinIO | MinIO Security Feature Bypass Vulnerability | Unknown | CWE-269 | ||
| CVE-2022-22265 | Samsung | Mobile Devices | Samsung Mobile Devices Use-After-Free Vulnerability | Unknown | CWE-703 | ||
| CVE-2021-3129 | Laravel | Ignition | Laravel Ignition File Upload Vulnerability | Known | none listed | ||
| CVE-2017-6884 | Zyxel | EMG2926 Routers | Zyxel EMG2926 Routers Command Injection Vulnerability | Known | CWE-78 | ||
| CVE-2014-8361 | Realtek | SDK | Realtek SDK Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2023-26369 | Adobe | Acrobat and Reader | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-4863 | Chromium WebP | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-787 | |||
| CVE-2023-35674 | Android | Framework | Android Framework Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2023-20269 | Cisco | Adaptive Security Appliance and Firepower Threat Defense | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | Known | CWE-288 | ||
| CVE-2023-36802 | Microsoft | Streaming Service Proxy | Microsoft Streaming Service Proxy Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-36761 | Microsoft | Word | Microsoft Word Information Disclosure Vulnerability | Unknown | CWE-668 | ||
| CVE-2023-41064 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability | Unknown | CWE-120 | ||
| CVE-2023-41061 | Apple | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2023-33246 | Apache | RocketMQ | Apache RocketMQ Command Execution Vulnerability | Unknown | CWE-94 | ||
| CVE-2023-38831 | RARLAB | WinRAR | RARLAB WinRAR Code Execution Vulnerability | Known | CWE-351 | ||
| CVE-2023-32315 | Ignite Realtime | Openfire | Ignite Realtime Openfire Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2023-38035 | Ivanti | Sentry | Ivanti Sentry Authentication Bypass Vulnerability | Known | CWE-863 | ||
| CVE-2023-27532 | Veeam | Backup & Replication | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | Known | CWE-306 | ||
| CVE-2023-26359 | Adobe | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2023-24489 | Citrix | Content Collaboration | Citrix Content Collaboration ShareFile Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2023-38180 | Microsoft | .NET Core and Visual Studio | Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability | Unknown | none listed | ||
| CVE-2017-18368 | Zyxel | P660HN-T1A Routers | Zyxel P660HN-T1A Routers Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2023-35081 | Ivanti | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2023-37580 | Synacor | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2023-38606 | Apple | Multiple Products | Apple Multiple Products Kernel Unspecified Vulnerability | Unknown | none listed | ||
| CVE-2023-35078 | Ivanti | Endpoint Manager Mobile (EPMM) | Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability | Known | CWE-287 | ||
| CVE-2023-38205 | Adobe | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2023-29298 | Adobe | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2023-3519 | Citrix | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | Known | CWE-94 | ||
| CVE-2023-36884 | Microsoft | Windows | Microsoft Windows Search Remote Code Execution Vulnerability | Known | CWE-362 | ||
| CVE-2023-37450 | Apple | Multiple Products | Apple Multiple Products WebKit Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2022-29303 | SolarView | Compact | SolarView Compact Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2023-36874 | Microsoft | Windows | Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability | Unknown | CWE-59 | ||
| CVE-2023-35311 | Microsoft | Outlook | Microsoft Outlook Security Feature Bypass Vulnerability | Unknown | CWE-367 | ||
| CVE-2023-32049 | Microsoft | Windows | Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability | Unknown | none listed | ||
| CVE-2023-32046 | Microsoft | Windows | Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2022-31199 | Netwrix | Auditor | Netwrix Auditor Insecure Object Deserialization Vulnerability | Known | CWE-502, CWE-122 | ||
| CVE-2021-29256 | Arm | Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-25489 | Samsung | Mobile Devices | Samsung Mobile Devices Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2021-25487 | Samsung | Mobile Devices | Samsung Mobile Devices Out-of-Bounds Read Vulnerability | Unknown | CWE-125 | ||
| CVE-2021-25395 | Samsung | Mobile Devices | Samsung Mobile Devices Race Condition Vulnerability | Unknown | CWE-362 | ||
| CVE-2021-25394 | Samsung | Mobile Devices | Samsung Mobile Devices Race Condition Vulnerability | Unknown | CWE-416 | ||
| CVE-2021-25372 | Samsung | Mobile Devices | Samsung Mobile Devices Improper Boundary Check Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-25371 | Samsung | Mobile Devices | Samsung Mobile Devices Unspecified Vulnerability | Unknown | CWE-912 | ||
| CVE-2019-20500 | D-Link | DWL-2600AP Access Point | D-Link DWL-2600AP Access Point Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2019-17621 | D-Link | DIR-859 Router | D-Link DIR-859 Router Command Execution Vulnerability | Unknown | CWE-78 | ||
| CVE-2023-32439 | Apple | Multiple Products | Apple Multiple Products WebKit Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2023-32435 | Apple | Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-32434 | Apple | Multiple Products | Apple Multiple Products Integer Overflow Vulnerability | Unknown | CWE-190 | ||
| CVE-2023-27992 | Zyxel | Multiple Network-Attached Storage (NAS) Devices | Zyxel Multiple NAS Devices Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2023-20867 | VMware | Tools | VMware Tools Authentication Bypass Vulnerability | Unknown | CWE-287 | ||
| CVE-2023-20887 | VMware | Aria Operations for Networks | Vmware Aria Operations for Networks Command Injection Vulnerability | Unknown | CWE-77 | ||
| CVE-2021-44026 | Roundcube | Roundcube Webmail | Roundcube Webmail SQL Injection Vulnerability | Unknown | CWE-89 | ||
| CVE-2020-35730 | Roundcube | Roundcube Webmail | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2020-12641 | Roundcube | Roundcube Webmail | Roundcube Webmail Remote Code Execution Vulnerability | Unknown | CWE-78 | ||
| CVE-2016-9079 | Mozilla | Firefox, Firefox ESR, and Thunderbird | Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2016-0165 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2023-27997 | Fortinet | FortiOS and FortiProxy SSL-VPN | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | Known | CWE-122 | ||
| CVE-2023-3079 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | |||
| CVE-2023-33010 | Zyxel | Multiple Firewalls | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Unknown | CWE-120 | ||
| CVE-2023-33009 | Zyxel | Multiple Firewalls | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Unknown | CWE-120 | ||
| CVE-2023-34362 | Progress | MOVEit Transfer | Progress MOVEit Transfer SQL Injection Vulnerability | Known | CWE-89 | ||
| CVE-2023-28771 | Zyxel | Multiple Firewalls | Zyxel Multiple Firewalls OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2023-2868 | Barracuda Networks | Email Security Gateway (ESG) Appliance | Barracuda Networks ESG Appliance Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2023-32409 | Apple | Multiple Products | Apple Multiple Products WebKit Sandbox Escape Vulnerability | Unknown | none listed | ||
| CVE-2023-32373 | Apple | Multiple Products | Apple Multiple Products WebKit Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-28204 | Apple | Multiple Products | Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability | Unknown | CWE-125 | ||
| CVE-2023-21492 | Samsung | Mobile Devices | Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability | Unknown | CWE-532 | ||
| CVE-2016-6415 | Cisco | IOS, IOS XR, and IOS XE | Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2004-1464 | Cisco | IOS | Cisco IOS Denial-of-Service Vulnerability | Unknown | none listed | ||
| CVE-2023-25717 | Ruckus Wireless | Multiple Products | Multiple Ruckus Wireless Products CSRF and RCE Vulnerability | Unknown | CWE-94 | ||
| CVE-2021-3560 | Red Hat | Polkit | Red Hat Polkit Incorrect Authorization Vulnerability | Unknown | CWE-863 | ||
| CVE-2016-8735 | Apache | Tomcat | Apache Tomcat Remote Code Execution Vulnerability | Unknown | CWE-284 | ||
| CVE-2016-3427 | Oracle | Java SE and JRockit | Oracle Java SE and JRockit Unspecified Vulnerability | Unknown | none listed | ||
| CVE-2015-5317 | Jenkins | Jenkins User Interface (UI) | Jenkins User Interface (UI) Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2014-0196 | Linux | Kernel | Linux Kernel Race Condition Vulnerability | Unknown | CWE-362 | ||
| CVE-2010-3904 | Linux | Kernel | Linux Kernel Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2023-29336 | Microsoft | Win32k | Microsoft Win32K Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-21839 | Oracle | WebLogic Server | Oracle WebLogic Server Unspecified Vulnerability | Unknown | none listed | ||
| CVE-2023-1389 | TP-Link | Archer AX21 | TP-Link Archer AX-21 Command Injection Vulnerability | Unknown | CWE-77 | ||
| CVE-2021-45046 | Apache | Log4j2 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability | Known | CWE-917 | ||
| CVE-2023-28432 | MinIO | MinIO | MinIO Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2023-27350 | PaperCut | MF/NG | PaperCut MF/NG Improper Access Control Vulnerability | Known | CWE-284 | ||
| CVE-2023-2136 | Chromium Skia | Google Chrome Skia Integer Overflow Vulnerability | Unknown | CWE-190 | |||
| CVE-2017-6742 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | Unknown | CWE-119 | ||
| CVE-2023-2033 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | |||
| CVE-2019-8526 | Apple | macOS | Apple macOS Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-29492 | Novi Survey | Novi Survey | Novi Survey Insecure Deserialization Vulnerability | Unknown | CWE-94 | ||
| CVE-2023-20963 | Android | Framework | Android Framework Privilege Escalation Vulnerability | Unknown | CWE-295 | ||
| CVE-2023-28252 | Microsoft | Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Known | CWE-122 | ||
| CVE-2023-28206 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-28205 | Apple | Multiple Products | Apple Multiple Products WebKit Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-26083 | Arm | Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Driver Information Disclosure Vulnerability | Unknown | CWE-401 | ||
| CVE-2021-27878 | Veritas | Backup Exec Agent | Veritas Backup Exec Agent Command Execution Vulnerability | Known | CWE-287 | ||
| CVE-2021-27877 | Veritas | Backup Exec Agent | Veritas Backup Exec Agent Improper Authentication Vulnerability | Known | CWE-287 | ||
| CVE-2021-27876 | Veritas | Backup Exec Agent | Veritas Backup Exec Agent File Access Vulnerability | Known | CWE-287 | ||
| CVE-2019-1388 | Microsoft | Windows | Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability | Known | CWE-269 | ||
| CVE-2022-27926 | Synacor | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79, CWE-138 | ||
| CVE-2023-0266 | Linux | Kernel | Linux Kernel Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2022-42948 | Fortra | Cobalt Strike | Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability | Unknown | CWE-79, CWE-116 | ||
| CVE-2022-39197 | Fortra | Cobalt Strike | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-20, CWE-79 | ||
| CVE-2022-38181 | Arm | Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2022-3038 | Chromium Network Service | Google Chromium Network Service Use-After-Free Vulnerability | Unknown | CWE-416 | |||
| CVE-2022-22706 | Arm | Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Driver Unspecified Vulnerability | Unknown | CWE-119 | ||
| CVE-2021-30900 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | Unknown | CWE-20, CWE-787 | ||
| CVE-2017-7494 | Samba | Samba | Samba Remote Code Execution Vulnerability | Known | CWE-94 | ||
| CVE-2013-3163 | Microsoft | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Unknown | CWE-94 | ||
| CVE-2023-26360 | Adobe | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Unknown | CWE-284 | ||
| CVE-2023-24880 | Microsoft | Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | Known | CWE-863 | ||
| CVE-2023-23397 | Microsoft | Office | Microsoft Office Outlook Privilege Escalation Vulnerability | Unknown | CWE-294 | ||
| CVE-2022-41328 | Fortinet | FortiOS | Fortinet FortiOS Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2021-39144 | XStream | XStream | XStream Remote Code Execution Vulnerability | Unknown | CWE-94, CWE-502 | ||
| CVE-2020-5741 | Plex | Media Server | Plex Media Server Remote Code Execution Vulnerability | Unknown | CWE-502 | ||
| CVE-2022-35914 | Teclib | GLPI | Teclib GLPI Remote Code Execution Vulnerability | Unknown | CWE-74 | ||
| CVE-2022-33891 | Apache | Spark | Apache Spark Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2022-28810 | Zoho | ManageEngine | Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability | Unknown | CWE-78, CWE-259 | ||
| CVE-2022-36537 | ZK Framework | AuUploader | ZK Framework AuUploader Unspecified Vulnerability | Known | CWE-441 | ||
| CVE-2022-47986 | IBM | Aspera Faspex | IBM Aspera Faspex Code Execution Vulnerability | Known | CWE-502 | ||
| CVE-2022-41223 | Mitel | MiVoice Connect | Mitel MiVoice Connect Code Injection Vulnerability | Known | CWE-94 | ||
| CVE-2022-40765 | Mitel | MiVoice Connect | Mitel MiVoice Connect Command Injection Vulnerability | Known | CWE-77 | ||
| CVE-2022-46169 | Cacti | Cacti | Cacti Command Injection Vulnerability | Unknown | CWE-74 | ||
| CVE-2023-23529 | Apple | Multiple Products | Apple Multiple Products WebKit Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2023-23376 | Microsoft | Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Known | CWE-122 | ||
| CVE-2023-21823 | Microsoft | Windows | Microsoft Windows Graphic Component Privilege Escalation Vulnerability | Unknown | CWE-190 | ||
| CVE-2023-21715 | Microsoft | Office | Microsoft Office Publisher Security Feature Bypass Vulnerability | Unknown | CWE-863 | ||
| CVE-2023-0669 | Fortra | GoAnywhere MFT | Fortra GoAnywhere MFT Remote Code Execution Vulnerability | Known | CWE-502 | ||
| CVE-2022-24990 | TerraMaster | TerraMaster OS | TerraMaster OS Remote Command Execution Vulnerability | Known | CWE-306 | ||
| CVE-2015-2291 | Intel | Ethernet Diagnostics Driver for Windows | Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability | Known | CWE-20 | ||
| CVE-2023-22952 | SugarCRM | Multiple Products | Multiple SugarCRM Products Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2022-21587 | Oracle | E-Business Suite | Oracle E-Business Suite Unspecified Vulnerability | Known | CWE-306 | ||
| CVE-2017-11357 | Telerik | User Interface (UI) for ASP.NET AJAX | Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability | Known | CWE-20 | ||
| CVE-2022-47966 | Zoho | ManageEngine | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | Known | none listed | ||
| CVE-2022-44877 | CWP | Control Web Panel | CWP Control Web Panel OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2023-21674 | Microsoft | Windows | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2022-41080 | Microsoft | Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | Known | none listed |
Cite this
CISA added 187 vulnerabilities to its KEV catalog in 2023. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/kev/2023/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.