CISA Known Exploited Vulnerabilities
KEV additions — October 2023
18 CVEs entered the KEV catalog in October 2023.
Added October 31, 20232
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-46747ransomware | F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability | 9.8 | 94.4 % | November 21, 2023 |
| CVE-2023-46748 | F5 BIG-IP Configuration Utility SQL Injection Vulnerability | 8.8 | 4.3 % | November 21, 2023 |
Added October 26, 20231
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-5631 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 5.4 | 85.2 % | November 16, 2023 |
Added October 23, 20231
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-20273 | Cisco IOS XE Web UI Command Injection Vulnerability | 7.2 | 92.4 % | October 27, 2023 |
Added October 18, 20231
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-4966ransomware | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | 7.5 | 94.3 % | November 8, 2023 |
Added October 16, 20231
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-20198 | Cisco IOS XE Web UI Privilege Escalation Vulnerability | 10 | 94.0 % | October 20, 2023 |
Added October 10, 20235
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-20109 | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | 6.6 | 0.6 % | October 31, 2023 |
| CVE-2023-21608 | Adobe Acrobat and Reader Use-After-Free Vulnerability | 7.8 | 84.1 % | October 31, 2023 |
| CVE-2023-36563 | Microsoft WordPad Information Disclosure Vulnerability | 5.5 | 2.5 % | October 31, 2023 |
| CVE-2023-41763 | Microsoft Skype for Business Privilege Escalation Vulnerability | 5.3 | 12.7 % | October 31, 2023 |
| CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability | 7.5 | 94.4 % | October 31, 2023 |
Added October 5, 20233
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-22515ransomware | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | 9.8 | 94.3 % | October 13, 2023 |
| CVE-2023-40044ransomware | Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | 8.8 | 94.4 % | October 26, 2023 |
| CVE-2023-42824 | Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability | 7.8 | 1.1 % | October 26, 2023 |
Added October 4, 20232
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-28229 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | 7 | 7.2 % | October 25, 2023 |
| CVE-2023-42793ransomware | JetBrains TeamCity Authentication Bypass Vulnerability | 9.8 | 92.9 % | October 25, 2023 |
Added October 3, 20231
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-4211 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | 5.5 | 0.3 % | October 24, 2023 |
Added October 2, 20231
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2023-5217 | Google Chromium libvpx Heap Buffer Overflow Vulnerability | 8.8 | 3.5 % | October 23, 2023 |