KEV 2023

Microsoft Exchange Server — Authenticated RCE via PowerShell SOAP Deserialization

Windows CLFS Driver — Kernel Pool Corruption via BLF File Parsing Leading to Privilege Escalation

PaperCut NG/MF — Pre-Auth Authentication Bypass via SecurityRequestFilter Enabling Information Disclosure

Apple Multiple Products — Apple Multiple products Use-After-Free Vulnerability

Apple iOS and iPadOS — Apple iOS and iPadOS Use-After-Free Vulnerability

Digiever DS-2105 Pro — Digiever DS-2105 Pro Missing Authorization Vulnerability

PaperCut NG/MF — PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability

TP-Link Multiple Routers — TP-Link Multiple Routers Command Injection Vulnerability

ASUS RT-AX55 Routers — ASUS RT-AX55 Routers OS Command Injection Vulnerability

Linux Kernel — Linux Kernel Improper Ownership Management Vulnerability

ZKTeco BioTime — ZKTeco BioTime Path Traversal Vulnerability

SonicWall SMA100 Appliances — SonicWall SMA100 Appliances OS Command Injection Vulnerability

North Grid Proself — North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability

Microsoft SharePoint Server — Microsoft SharePoint Server Code Injection Vulnerability

Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability

Microsoft Streaming Service — Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability

Apache Superset — Apache Superset Insecure Default Initialization of Resource Vulnerability

Google Chromium WebRTC — Google Chromium WebRTC Heap Buffer Overflow Vulnerability

Citrix NetScaler ADC and NetScaler Gateway — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

Ivanti Connect Secure and Policy Secure — Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability

Apple Multiple Products — Apple Multiple Products Code Execution Vulnerability

Spreadsheet::ParseExcel Spreadsheet::ParseExcel — Spreadsheet::ParseExcel Remote Code Execution Vulnerability

FXC AE1021, AE1021PE — FXC AE1021, AE1021PE OS Command Injection Vulnerability

Apple Multiple Products — Apple Multiple Products WebKit Memory Corruption Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Integer Overflow Vulnerability

Qlik Sense — Qlik Sense Path Traversal Vulnerability

QNAP VioStor NVR — QNAP VioStor NVR OS Command Injection Vulnerability

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Microsoft Windows — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

GNU GNU C Library — GNU C Library Buffer Overflow Vulnerability

Microsoft Windows — Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability

Microsoft Windows — Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability

IETF Service Location Protocol (SLP) — Service Location Protocol (SLP) Denial-of-Service Vulnerability

F5 BIG-IP Configuration Utility — F5 BIG-IP Configuration Utility SQL Injection Vulnerability

Google Chromium libvpx — Google Chromium libvpx Heap Buffer Overflow Vulnerability

Adobe Acrobat and Reader — Adobe Acrobat and Reader Use-After-Free Vulnerability

Apple iOS and iPadOS — Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability

HTTP/2 Protocol — Protocol-Level Denial of Service

Cisco Cisco IOS XE Web UI — Cisco IOS XE Web UI Command Injection Vulnerability

Microsoft Windows CNG Key Isolation Service — Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

Apple Multiple Products — Apple Multiple Products WebKit Code Execution Vulnerability

MinIO MinIO — MinIO Security Feature Bypass Vulnerability

Google Chromium WebP — Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Apple Multiple Products — Apple Multiple Products Kernel Privilege Escalation Vulnerability

Adobe Acrobat and Reader — Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

Android Framework — Android Framework Privilege Escalation Vulnerability

Microsoft Streaming Service Proxy — Microsoft Streaming Service Proxy Privilege Escalation Vulnerability

Apple iOS, iPadOS, and watchOS — Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability

Apple iOS, iPadOS, and macOS — Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability

Trend Micro Apex One and Worry-Free Business Security — Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability

Ignite Realtime Openfire — Ignite Realtime Openfire Path Traversal Vulnerability

RARLAB WinRAR — RARLAB WinRAR Code Execution Vulnerability

Veeam Backup & Replication — Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

Microsoft .NET Core and Visual Studio — Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

Apple Multiple Products — Apple Multiple Products WebKit Code Execution Vulnerability

Microsoft Windows — Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability

Microsoft Outlook — Microsoft Outlook Security Feature Bypass Vulnerability

Microsoft Windows — Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability

Microsoft Windows — Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

Adobe ColdFusion — Adobe ColdFusion Improper Access Control Vulnerability

Adobe ColdFusion — Adobe ColdFusion Improper Access Control Vulnerability

Microsoft Windows — Microsoft Windows Search Remote Code Execution Vulnerability

Ivanti EPMM — Authenticated Arbitrary File Write via Path Traversal, Enabling Webshell Deployment

Apple Multiple Products — Apple Multiple Products WebKit Memory Corruption Vulnerability

Apple Multiple Products — Apple Multiple Products WebKit Type Confusion Vulnerability

Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability

Apple Multiple Products — Apple Multiple Products Integer Overflow Vulnerability

Apple Multiple Products — Apple Multiple Products WebKit Use-After-Free Vulnerability

TP-Link Archer AX21 — TP-Link Archer AX-21 Command Injection Vulnerability

Apple Multiple Products — Apple Multiple Products WebKit Sandbox Escape Vulnerability

Microsoft Win32k — Microsoft Win32K Privilege Escalation Vulnerability

Oracle WebLogic Server — Oracle WebLogic Server Unspecified Vulnerability

Google Chromium V8 — Google Chromium V8 Type Confusion Vulnerability

Apple Multiple Products — Apple Multiple Products WebKit Use-After-Free Vulnerability

Apple iOS, iPadOS, and macOS — Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability

Android Framework — Android Framework Privilege Escalation Vulnerability

Microsoft Windows — Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

MinIO MinIO — MinIO Information Disclosure Vulnerability

Adobe ColdFusion — Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Linux Kernel — Linux Kernel Use-After-Free Vulnerability

Apple Multiple Products — Apple Multiple Products WebKit Type Confusion Vulnerability

SugarCRM Multiple Products — Multiple SugarCRM Products Remote Code Execution Vulnerability

Microsoft Windows — Microsoft Windows Graphic Component Privilege Escalation Vulnerability

Microsoft Windows — Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Microsoft Office — Microsoft Office Publisher Security Feature Bypass Vulnerability

Fortra GoAnywhere MFT — Fortra GoAnywhere MFT Remote Code Execution Vulnerability

Microsoft Windows — Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability