Week 8, 2018

19–25 February 2018

New CVEs: 242
Critical: 5
High: 7
Newly exploited: 0
Advisories: 57
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2018-7251 Anchor CMS Logs Credentials
EPSS 72%
Critical 9.8
CVE-2017-7375 A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, exte…
EPSS 3%
Critical 9.8
CVE-2017-18197 mxGraph vulnerable to XXE attacks
EPSS 2.9%
Critical 9.8
CVE-2018-6487 MFSBGN03799 rev.1 - Micro Focus UCMDB, Remote Disclosure of Information
Micro Focus · Universal CMDB Foundation Software

EPSS 1.9%
Critical 9.8
CVE-2018-0015 AppFormix: Debug Shell Command Execution in AppFormix Agent
Juniper Networks · AppFormix

EPSS 1.1%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories