Week 1, 2018

1–7 January 2018

New CVEs: 206
Critical: 6
High: 14
Newly exploited: 0
Advisories: 41
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2017-1000486 Inadequate Encryption Strength
EPSS 94%
Critical 9.8
CVE-2017-8046 Remote code execution in PATCH requests in Spring Data REST
Pivotal · Pivotal Spring Data REST and Spring Boot

EPSS 75%
Critical 9.8
CVE-2017-1000487 OS Command Injection in Plexus-utils
EPSS 6.5%
Critical 9.8
CVE-2017-1000469 Cobbler vulnerable to arbitrary code execution
EPSS 5.6%
Critical 9.8
CVE-2017-1000480 Smarty PHP code injection
EPSS 3.1%
Critical 9.8
CVE-2017-1000430 Integer overflow in base64
EPSS 1.5%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories