Week 27, 2023

3–9 July 2023

New CVEs: 474
Critical: 20
High: 139
Newly exploited: 1
Advisories: 139
Malicious pkgs: 41

Newly exploited 1

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 8.8
CVE-2021-29256 KEV Jul 7, 2023 . The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation.…
EPSS 3%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.0
CVE-2023-34192 Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoS…
EPSS 77%
Critical 10.0
CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments
mastodon · mastodon

EPSS 40%
Critical 9.8
CVE-2023-35797 Apache Airflow Hive Provider Beeline RCE with Principal
Apache Software Foundation · Apache Airflow Apache Hive Provider

EPSS 2.8%
Critical 9.8
CVE-2023-23902 A buffer overflow vulnerability exists in the uhttpd login functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to remote c…
Milesight · UR32L

EPSS 2.2%
Critical 9.8
CVE-2023-36188 langchain vulnerable to arbitrary code execution
EPSS 1.9%
Critical 9.8
CVE-2023-36665 protobufjs Prototype Pollution vulnerability
EPSS 1.7%
Critical 9.8
CVE-2023-29824 A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor and discoverer indicate that this is not …
EPSS 1.3%
Critical 9.3
CVE-2023-36459 Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards
mastodon · mastodon

EPSS 1.2%
Critical 9.1
CVE-2023-3551 Code Injection in nilsteampassnet/teampass
nilsteampassnet · nilsteampassnet/teampass

EPSS 1.1%
Critical 9.8
CVE-2023-36258 langchain arbitrary code execution vulnerability
EPSS 1.1%
Critical 9.8
CVE-2023-3045 SQLi in Tise Technology's Parking Web Report
Tise Technology · Parking Web Report
Critical 9.6
CVE-2023-37262 CC: Tweaked SSRF to Cloud Services Metadata Services not Blocked by Default
cc-tweaked · CC-Tweaked
Critical 9.8
CVE-2023-2046 SQLi in Yontem Vehicle TrackingSsystem
Yontem Informatics · Vehicle Tracking System
Critical 9.8
CVE-2023-2852 SQLi in SoftMed's SelfPatron
Softmed · SelfPatron
Critical 10.0
CVE-2021-32494 Radare2 has a division by zero vulnerability in Mach-O parser's rebase_buffer function. This allow attackers to create malicious inputs that can cause denial o…
radare2 · radare2

All 20 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

DSA-5448-1 linux - security update 12 CVEs
ICSA-23-187-01 PiiGAB M-Bus 9 CVEs
SUSE-SU-2023:2783-1 Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websoc 7 CVEs
USN-6209-1 Gerbv vulnerabilities 6 CVEs
RLSA-2023:3923 Critical: go-toolset and golang security update 4 CVEs
ELSA-2023-3923 Critical: go-toolset and golang security update (Oracle Linux 9) 4 CVEs
ELSA-2023-3922 Critical: go-toolset:ol8 security update (Oracle Linux 8) 4 CVEs
DSA-5447-1 mediawiki - security update 3 CVEs
DLA-3487-1 fusiondirectory - security update 2 CVEs
USN-6204-1 cpdb-libs vulnerability 1 CVEs