CVEs from 2023

6,664 normalized CVEs published or assigned in this year.

Total
6,664
critical
critical 222
high
high 1,548
medium
medium 1,277
low
low 23
% Critical
3.3%
% with KEV
2.4%
% with exploit
2.5%

Top products

  • office 29
  • office_long_term_servicing_channel 15
  • 365_apps 14
  • openstack_platform 6
  • codeready_linux_builder_for_ibm_z_systems_eus 6
  • registrationmagic 6
  • codeready_linux_builder_eus 6
  • cbot_panel 6
0
KEVHas exploit
Reset
CVE Severity CVSS Risk Published Description Impact
CVE-2023-1728 critical 9.8 9.8 3y ago Unrestricted Upload of File with Dangerous Type vulnerability in Fernus Informatics LMS allows OS Command Injection, Server Side Include (SSI) Injection. This issue affects LMS: before 23.04.03.
CVE-2023-1765 critical 9.8 9.8 3y ago Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Akbim Computer Panon allows SQL Injection. This issue affects Panon: before 1.0.2.
CVE-2023-1725 critical 9.8 9.8 3y ago Server-Side Request Forgery (SSRF) vulnerability in Infoline Project Management System allows Server Side Request Forgery. This issue affects Project Management System: before 4.09.31.125.
CVE-2023-28531 critical 9.8 9.8 3y ago ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. debian
CVE-2023-33150 critical 9.6 9.6 3y ago Microsoft Office Security Feature Bypass Vulnerability windows
CVE-2023-43641 critical 9.5 libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited… archsusedebian
CVE-2023-5388 critical 9.5 2y ago Critical: firefox security update redhatrockylinuxdebiansuse
CVE-2023-46848 critical 9.5 3y ago Critical: squid security update redhatsuserockylinuxdebian
CVE-2023-46847 critical 9.5 3y ago Critical: squid security update redhatrockylinuxsusedebian
CVE-2023-46846 critical 9.5 3y ago Critical: squid security update redhatrockylinuxsusedebian
CVE-2023-45853 critical 9.5 3y ago pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency archsusedebianpython
CVE-2023-3128 critical 9.5 3y ago Critical: grafana security update redhatsuserockylinuxgolang
CVE-2023-29404 critical 9.5 3y ago Critical: go-toolset and golang security update redhatdebianrockylinuxgolang
CVE-2023-29402 critical 9.5 3y ago Critical: go-toolset and golang security update redhatdebianrockylinuxgolang
CVE-2023-29403 critical 9.5 3y ago Critical: go-toolset and golang security update redhatdebianrockylinuxgolang
CVE-2023-29405 critical 9.5 3y ago Critical: go-toolset and golang security update redhatdebianrockylinuxgolang
CVE-2023-28787 critical 9.3 9.3 2y ago Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.…
CVE-2023-24215 critical 9.1 9.1 10d ago Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administrator credentials via a crafted POST request.
CVE-2023-47842 critical 9.1 9.1 2y ago Unrestricted Upload of File with Dangerous Type vulnerability in Zachary Segal CataBlog.This issue affects CataBlog: from n/a through 1.7.0.
CVE-2023-29386 critical 9.1 9.1 2y ago Unrestricted Upload of File with Dangerous Type vulnerability in Julien Crego Manager for Icomoon.This issue affects Manager for Icomoon: from n/a through 2.0.
CVE-2023-49166 critical 9.1 9.1 3y ago Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0.
CVE-2023-49161 critical 9.1 9.1 3y ago Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Guelben Bravo Translate.This issue affects Bravo Translate: from n/a through 1.2.
CVE-2023-50885 medium 6.8 6.8 2y ago Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AGILELOGIX Store Locator WordPress.This issue affects Store Locator WordPress: from n/a through 1.4.14.
CVE-2023-52447 medium 6.7 6.7 2y ago In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may stil… susedebianlinux
CVE-2023-7345 medium 6.5 6.5 9d ago Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting inc…
CVE-2023-25997 medium 6.5 6.5 1y ago Missing Authorization vulnerability in SolaPlugins Sola Support Ticket allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sola Support Ticket: from n/a throug…
CVE-2023-45633 medium 6.5 6.5 1y ago Missing Authorization vulnerability in IDX IMPress Listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IMPress Listings: from n/a through 2.6.2.
CVE-2023-47689 medium 6.5 6.5 1y ago Missing Authorization vulnerability in Toast Plugins Animator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animator: from n/a through 3.0.10.
CVE-2023-47180 medium 6.5 6.5 1y ago Missing Authorization vulnerability in XLPlugins Finale Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Finale Lite: from n/a through 2.16.0.
CVE-2023-46644 medium 6.5 6.5 1y ago Missing Authorization vulnerability in WP CTA PRO WordPress CTA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress CTA: from n/a through 1.5.8.
CVE-2023-46631 medium 6.5 6.5 1y ago Missing Authorization vulnerability in RevenueHunt Product Recommendation Quiz for eCommerce product-recommendation-quiz-for-ecommerce allows Exploiting Incorrectly Configured Access Control Security…
CVE-2023-46610 medium 6.5 6.5 1y ago Missing Authorization vulnerability in Mohamed Magdy Quill Forms quillforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quill Forms: from n/a through <=…
CVE-2023-46609 medium 6.5 6.5 1y ago Missing Authorization vulnerability in FeedFocal FeedFocal feedfocal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FeedFocal: from n/a through <= 1.2.2.
CVE-2023-46195 medium 6.5 6.5 1y ago Missing Authorization vulnerability in CoSchedule Headline Analyzer headline-analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headline Analyzer: fro…
CVE-2023-45275 medium 6.5 6.5 1y ago Missing Authorization vulnerability in WP Chill Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through <= 2.3.28.
CVE-2023-41686 medium 6.5 6.5 2y ago Cross-Site Request Forgery (CSRF) vulnerability in ilGhera Woocommerce Support System allows Cross Site Request Forgery.This issue affects Woocommerce Support System: from n/a through 1.2.2.
CVE-2023-41664 medium 6.5 6.5 2y ago Missing Authorization vulnerability in AlphaBPO Easy Newsletter Signups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Newsletter Signups: from n/a th…
CVE-2023-41649 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Ovic Team Ovic Product Bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ovic Product Bundle: from n/a through 1…
CVE-2023-37987 medium 6.5 6.5 2y ago Missing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YourMembership Single Sign O…
CVE-2023-37971 medium 6.5 6.5 2y ago Missing Authorization vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Stoc…
CVE-2023-37887 medium 6.5 6.5 2y ago Missing Authorization vulnerability in WPSchoolPress Team WPSchoolPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSchoolPress: from n/a through 2.2.…
CVE-2023-34019 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit for LearnDa…
CVE-2023-33994 medium 6.5 6.5 2y ago Missing Authorization vulnerability in VeronaLabs Slimstat Analytics wp-slimstat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slimstat Analytics: from n/…
CVE-2023-33324 medium 6.5 6.5 2y ago Missing Authorization vulnerability in wppal Easy Captcha allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Captcha: from n/a through 1.0.
CVE-2023-32506 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Link Whisper Link Whisper Free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Link Whisper Free: from n/a through 0.…
CVE-2023-50884 medium 6.5 6.5 2y ago Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA…
CVE-2023-49857 medium 6.5 6.5 2y ago Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from …
CVE-2023-49848 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Marc dooder Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy woo-aliexpress-dropshipping allows Exploiting Incorrectly Configured Access Control Se…
CVE-2023-49167 medium 6.5 6.5 2y ago Missing Authorization vulnerability in code4life Database for CF7 database-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Database for CF7: from n/…
CVE-2023-48779 medium 6.5 6.5 2y ago Missing Authorization vulnerability in 3DWeb 360 Javascript Viewer 360deg-javascript-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 360 Javascript V…
CVE-2023-48274 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Mondial Relay WooCommerce - WCMultiShipping WCMultiShipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCMultiSh…
CVE-2023-47764 medium 6.5 6.5 2y ago Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ditty: from n/a through <= …
CVE-2023-32299 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Sales Report ni-woocommerce-sales-report allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects N…
CVE-2023-30870 medium 6.5 6.5 2y ago Missing Authorization vulnerability in wooproductimporter Sharkdropship for AliExpress Dropship and Affiliate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect…
CVE-2023-28689 medium 6.5 6.5 2y ago Missing Authorization vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Job Manager: from n/a through 2.0.0.
CVE-2023-26522 medium 6.5 6.5 2y ago Missing Authorization vulnerability in OneWebsite WP Repost allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Repost: from n/a through 0.1.
CVE-2023-25966 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Ninja Team Filebird allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filebird: from n/a through 5.1.4.
CVE-2023-25454 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Nate Reist Protected Posts Logout Button allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protected Posts Logout Butto…
CVE-2023-25035 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Fullworks Quick Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Contact Form : from n/a through 8…
CVE-2023-28746 medium 6.5 6.5 2y ago Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processors may allow an authenticated user to potentially enable inf… redhatalmalinuxrockylinuxsuse+1
CVE-2023-46197 medium 6.5 6.5 2y ago Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in supsystic.Com Popup by Supsystic allows Relative Path Traversal.This issue affects Popup by Supsystic: …
CVE-2023-41651 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Multi-column Tag Map.This issue affects Multi-column Tag Map: from n/a through 17.0.26.
CVE-2023-6129 medium 6.5 6.5 2y ago Low: openssl and openssl-fips-provider security update redhatsuserockylinuxdebian+1
CVE-2023-3019 medium 6.5 6.5 2y ago Moderate: qemu-kvm security update redhatrockylinuxsusedebian
CVE-2023-23989 medium 6.5 6.5 2y ago Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.1.9.2.
CVE-2023-49768 medium 6.5 6.5 2y ago Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Stored XSS.This issue affects WP-FormAssembl…
CVE-2023-52234 medium 6.5 6.5 2y ago Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Elite for WooCommerce.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.2.
CVE-2023-52231 medium 6.5 6.5 2y ago Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Booster Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.
CVE-2023-36679 medium 6.5 6.5 2y ago Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6.
CVE-2023-52228 medium 6.5 6.5 2y ago Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Kinchin Beds24 Online Booking allows Stored XSS.This issue affects Beds24 Online Booking: fr…
CVE-2023-7251 medium 6.5 6.5 2y ago Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS.This issue affects User Submitted Posts: from n…
CVE-2023-49837 medium 6.5 6.5 2y ago Uncontrolled Resource Consumption vulnerability in David Artiss Code Embed.This issue affects Code Embed: from n/a through 2.3.6.
CVE-2023-52229 medium 6.5 6.5 2y ago Missing Authorization vulnerability in Save as PDF plugin by Pdfcrowd Word Replacer Pro.This issue affects Word Replacer Pro: from n/a through 1.0.
CVE-2023-51385 medium 6.5 6.5 2y ago Moderate: openssh security update redhatrockylinuxsusedebian
CVE-2023-46218 medium 6.5 6.5 2y ago Moderate: curl security and bug fix update redhatrockylinuxdebiansuse+1
CVE-2023-51681 medium 6.5 6.5 2y ago Cross-Site Request Forgery (CSRF) vulnerability in Duplicator Duplicator – WordPress Migration & Backup Plugin.This issue affects Duplicator – WordPress Migration & Backup Plugin: from n/a through 1.…
CVE-2023-24416 medium 6.5 6.5 2y ago Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arne Franken All In One Favicon.This issue affects All In One Favicon: from n/a through 4.7.
CVE-2023-51678 medium 6.5 6.5 2y ago Cross-Site Request Forgery (CSRF) vulnerability in Doofinder Doofinder WP & WooCommerce Search.This issue affects Doofinder WP & WooCommerce Search: from n/a through 2.0.33.
CVE-2023-51676 medium 6.5 6.5 2y ago Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor.This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1.
CVE-2023-49765 medium 6.5 6.5 3y ago Authorization Bypass Through User-Controlled Key vulnerability in Blaz K. Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.1.
CVE-2023-47191 medium 6.5 6.5 3y ago Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress.This issue affects Youzify –…
CVE-2023-32799 medium 6.5 6.5 3y ago Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from n/a through 3.8.3.
CVE-2023-31231 medium 6.5 6.5 3y ago Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This issue affects Unlimited Elements For Elemen…
CVE-2023-30872 medium 6.5 6.5 3y ago Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BannerSky BSK Forms Blacklist.This issue affects BSK Forms Blacklist: from n/a through 3.6.2.
CVE-2023-46311 medium 6.5 6.5 3y ago Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3.
CVE-2023-41796 medium 6.5 6.5 3y ago Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Gallerie…
CVE-2023-25715 medium 6.5 6.5 3y ago Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – The #1 gamification …
CVE-2023-47558 medium 6.5 6.5 3y ago Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mahlamusa Who Hit The Page – Hit Counter allows SQL Injection.This issue affects Who Hit The Page…
CVE-2023-37868 medium 6.5 6.5 3y ago Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Leap13 Premium Addons PRO.This issue affects Premium Addons PRO: from n/a through 2.9.0.
CVE-2023-26533 medium 6.5 6.5 3y ago Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.1.
CVE-2023-48333 medium 6.5 6.5 3y ago Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce.This issue affects Booster for WooCommerce: from n/a through 7.1.1.
CVE-2023-41239 medium 6.5 6.5 3y ago Server-Side Request Forgery (SSRF) vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry.This issue affects PowerPress Podcasting plugin by Blubrry: from n/a through 11.0.6.
CVE-2023-23800 medium 6.5 6.5 3y ago Server-Side Request Forgery (SSRF) vulnerability in Vova Anokhin WP Shortcodes Plugin — Shortcodes Ultimate.This issue affects WP Shortcodes Plugin — Shortcodes Ultimate: from n/a through 5.12.6.
CVE-2023-23684 medium 6.5 6.5 3y ago WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF) php
CVE-2023-4527 medium 6.5 6.5 3y ago Important: glibc security update redhatrockylinuxsusedebian+1
CVE-2023-36897 medium 6.5 6.5 3y ago Visual Studio Tools for Office Runtime Spoofing Vulnerability windows
CVE-2023-33151 medium 6.5 6.5 3y ago Microsoft Outlook Spoofing Vulnerability windows
CVE-2023-29237 medium 6.3 6.3 2y ago Missing Authorization vulnerability in Muhammad Rehman Remove Duplicate Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Remove Duplicate Posts: from n…
CVE-2023-27449 medium 6.3 6.3 2y ago Missing Authorization vulnerability in TotalSuite Total Poll Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through 4.8.6.
CVE-2023-31234 medium 6.3 6.3 2y ago Missing Authorization vulnerability in Tilda Publishing.This issue affects Tilda Publishing: from n/a through 0.3.23.