Patch first, page 5
As of , all 1,734 vulnerabilities on CISA's list of exploited vulnerabilities, in our patch-first order: 101 to patch now.
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 401 | CVE-2023-46747Authentication Bypass | F5 BIG-IP Configuration Utility | Patch this weekRansomware use; Metasploit module; EPSS 0.97 | 0.97 | ||
| 402 | CVE-2023-20273Command Injection | Cisco Cisco IOS XE Web UI | Patch this weekMetasploit module; EPSS 0.90 | 0.90 | ||
| 403 | CVE-2023-4966Buffer Overflow | Citrix NetScaler ADC and NetScaler Gateway | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 404 | CVE-2023-20198Privilege Escalation | Cisco IOS XE Web UI | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 405 | CVE-2023-22515Broken Access Control | Atlassian Confluence Data Center and Server | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 406 | CVE-2023-40044Deserialization of Untrusted Data | Progress WS_FTP Server | Patch this weekRansomware use; Metasploit module; EPSS 0.90 | 0.90 | ||
| 407 | CVE-2023-42793Authentication Bypass | JetBrains TeamCity | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 408 | CVE-2021-3129File Upload | Laravel Ignition | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 409 | CVE-2023-33246Command Execution | Apache RocketMQ | Patch this weekMetasploit module; EPSS 0.97 | 0.97 | ||
| 410 | CVE-2023-32315Path Traversal | Ignite Realtime Openfire | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 411 | CVE-2023-38831Code Execution | RARLAB WinRAR | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 412 | CVE-2023-38035Authentication Bypass | Ivanti Sentry | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 413 | CVE-2017-18368Command Injection | Zyxel P660HN-T1A Routers | Patch this weekMetasploit module; EPSS 0.94 | 0.94 | ||
| 414 | CVE-2023-3519Code Injection | Citrix NetScaler ADC and NetScaler Gateway | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 415 | CVE-2019-17621Command Execution | D-Link DIR-859 Router | Patch this weekMetasploit module; EPSS 0.90 | 0.90 | ||
| 416 | CVE-2023-20887Command Injection | VMware Aria Operations for Networks | Patch this weekMetasploit module; EPSS 0.98 | 0.98 | ||
| 417 | CVE-2023-34362SQL Injection | Progress MOVEit Transfer | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 418 | CVE-2023-28771OS Command Injection | Zyxel Multiple Firewalls | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 419 | CVE-2023-2868ESG Appliance Improper Input Validation | Barracuda Networks Email Security Gateway (ESG) Appliance | Patch this weekMetasploit module; EPSS 0.88 | 0.88 | ||
| 420 | CVE-2016-6415IKEv1 Information Disclosure | Cisco IOS, IOS XR, and IOS XE | Patch this weekMetasploit module; EPSS 0.88 | 0.88 | ||
| 421 | CVE-2021-45046Deserialization of Untrusted Data | Apache Log4j2 | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 422 | CVE-2023-21839Unspecified | Oracle WebLogic Server | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 423 | CVE-2023-27350Improper Access Control | PaperCut MF/NG | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 424 | CVE-2023-28432Information Disclosure | MinIO MinIO | Patch this weekMetasploit module; EPSS 0.84 | 0.84 | ||
| 425 | CVE-2021-27877Improper Authentication | Veritas Backup Exec Agent | Patch this weekRansomware use; Metasploit module; EPSS 0.65 | 0.65 | ||
| 426 | CVE-2023-26360Deserialization of Untrusted Data | Adobe ColdFusion | Patch this weekMetasploit module; EPSS 0.97 | 0.97 | ||
| 427 | CVE-2020-5741Remote Code Execution | Plex Media Server | Patch this weekMetasploit module; EPSS 0.73 | 0.73 | ||
| 428 | CVE-2021-39144Remote Code Execution | XStream XStream | Patch this weekMetasploit module; EPSS 0.98 | 0.98 | ||
| 429 | CVE-2022-28810ADSelfService Plus Remote Code Execution | Zoho ManageEngine | Patch this weekMetasploit module; EPSS 0.71 | 0.71 | ||
| 430 | CVE-2022-33891Command Injection | Apache Spark | Patch this weekMetasploit module; EPSS 0.93 | 0.93 | ||
| 431 | CVE-2022-35914Remote Code Execution | Teclib GLPI | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 432 | CVE-2022-46169Command Injection | Cacti Cacti | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 433 | CVE-2022-24990Remote Command Execution | TerraMaster TerraMaster OS | Patch this weekRansomware use; Metasploit module; EPSS 0.83 | 0.83 | ||
| 434 | CVE-2023-0669Remote Code Execution | Fortra GoAnywhere MFT | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 435 | CVE-2022-21587Unspecified | Oracle E-Business Suite | Patch this weekRansomware use; Metasploit module; EPSS 0.98 | 0.98 | ||
| 436 | CVE-2023-22952Multiple SugarCRM Products Remote Code Execution | SugarCRM Multiple Products | Patch this weekMetasploit module; EPSS 0.80 | 0.80 | ||
| 437 | CVE-2022-47966Multiple Products Remote Code Execution | Zoho ManageEngine | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 438 | CVE-2022-44877OS Command Injection | CWP Control Web Panel | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 439 | CVE-2021-35587Unspecified | Oracle Fusion Middleware | Patch this weekMetasploit module; EPSS 0.96 | 0.96 | ||
| 440 | CVE-2022-41352Arbitrary File Upload | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekRansomware use; Metasploit module; EPSS 0.95 | 0.95 | ||
| 441 | CVE-2022-40684Authentication Bypass | Fortinet Multiple Products | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 442 | CVE-2022-36804Command Injection | Atlassian Bitbucket Server and Data Center | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 443 | CVE-2022-41040Server-Side Request Forgery | Microsoft Exchange Server | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 444 | CVE-2022-41082Remote Code Execution | Microsoft Exchange Server | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 445 | CVE-2022-35405Multiple Products Remote Code Execution | Zoho ManageEngine | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 446 | CVE-2020-28949Deserialization of Untrusted Data | PEAR Archive_Tar | Patch this weekMetasploit module; EPSS 0.85 | 0.85 | ||
| 447 | CVE-2022-22963Function Remote Code Execution | VMware Tanzu Spring Cloud | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 448 | CVE-2022-24112Authentication Bypass | Apache APISIX | Patch this weekMetasploit module; EPSS 0.96 | 0.96 | ||
| 449 | CVE-2022-24706Insecure Default Initialization of Resource | Apache CouchDB | Patch this weekMetasploit module; EPSS 0.93 | 0.93 | ||
| 450 | CVE-2022-26352Unrestricted Upload of File | dotCMS dotCMS | Patch this weekRansomware use; Metasploit module; EPSS 0.91 | 0.91 | ||
| 451 | CVE-2022-26923Domain Services Privilege Escalation | Microsoft Active Directory | Patch this weekMetasploit module; EPSS 0.84 | 0.84 | ||
| 452 | CVE-2022-27925Arbitrary File Upload | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 453 | CVE-2022-37042Authentication Bypass | Synacor Zimbra Collaboration Suite (ZCS) | Patch this weekRansomware use; Metasploit module; EPSS 0.92 | 0.92 | ||
| 454 | CVE-2022-30333Directory Traversal | RARLAB UnRAR | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 455 | CVE-2021-4034Out-of-Bounds Read and Write | Red Hat Polkit | Patch this weekRansomware use; Metasploit module; EPSS 0.94 | 0.94 | ||
| 456 | CVE-2022-30190Support Diagnostic Tool (MSDT) Remote Code Execution | Microsoft Windows | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 457 | CVE-2019-7192Improper Access Control | QNAP Photo Station | Patch this weekRansomware use; Metasploit module; EPSS 0.88 | 0.88 | ||
| 458 | CVE-2019-7194Path Traversal | QNAP Photo Station | Patch this weekRansomware use; Metasploit module; EPSS 0.83 | 0.83 | ||
| 459 | CVE-2019-7195Path Traversal | QNAP Photo Station | Patch this weekRansomware use; Metasploit module; EPSS 0.90 | 0.90 | ||
| 460 | CVE-2022-26134Confluence Server and Data Center Remote Code Execution | Atlassian Confluence Server/Data Center | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 461 | CVE-2010-1428Information Disclosure | Red Hat JBoss | Patch this weekRansomware use; Metasploit module; EPSS 0.61 | 0.61 | ||
| 462 | CVE-2015-4495Security Feature Bypass | Mozilla Firefox | Patch this weekMetasploit module; EPSS 0.69 | 0.69 | ||
| 463 | CVE-2016-6366SNMP Buffer Overflow | Cisco Adaptive Security Appliance (ASA) | Patch this weekMetasploit module; EPSS 0.88 | 0.88 | ||
| 464 | CVE-2022-22947Code Injection | VMware Spring Cloud Gateway | Patch this weekMetasploit module; EPSS 0.98 | 0.98 | ||
| 465 | CVE-2022-30525OS Command Injection | Zyxel Multiple Firewalls | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 466 | CVE-2022-1388Missing Authentication | F5 BIG-IP | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 467 | CVE-2019-1003029Sandbox Bypass | Jenkins Script Security Plugin | Patch this weekMetasploit module; EPSS 0.74 | 0.74 | ||
| 468 | CVE-2022-0847Privilege Escalation | Linux Kernel | Patch this weekMetasploit module; EPSS 0.93 | 0.93 | ||
| 469 | CVE-2022-29464Unrestrictive Upload of File | WSO2 Multiple Products | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 470 | CVE-2022-22954Server-Side Template Injection | VMware Workspace ONE Access and Identity Manager | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 471 | CVE-2017-11317UI for ASP.NET AJAX Unrestricted File Upload | Telerik User Interface (UI) for ASP.NET AJAX | Patch this weekMetasploit module; EPSS 0.84 | 0.84 | ||
| 472 | CVE-2021-3156Heap-Based Buffer Overflow | Sudo Sudo | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 473 | CVE-2021-31166Remote Code Execution | Microsoft HTTP Protocol Stack | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 474 | CVE-2022-22965JDK 9+ Remote Code Execution | VMware Spring Framework | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 475 | CVE-2021-21551Insufficient Access Control | Dell dbutil Driver | Patch this weekMetasploit module; EPSS 0.79 | 0.79 | ||
| 476 | CVE-2016-0189Memory Corruption | Microsoft Internet Explorer | Patch this weekRansomware use; Metasploit module; EPSS 0.94 | 0.94 | ||
| 477 | CVE-2022-0543Debian-specific Redis Server Lua Sandbox Escape | Redis Debian-specific Redis Servers | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 478 | CVE-2015-3035Directory Traversal | TP-Link Multiple Archer Devices | Patch this weekMetasploit module; EPSS 0.84 | 0.84 | ||
| 479 | CVE-2016-11021OS Command Injection | D-Link DCS-930L Devices | Patch this weekMetasploit module; EPSS 0.69 | 0.69 | ||
| 480 | CVE-2017-3881Remote Code Execution | Cisco IOS and IOS XE | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 481 | CVE-2019-10068Deserialization of Untrusted Data | Kentico Xperience | Patch this weekMetasploit module; EPSS 0.95 | 0.95 | ||
| 482 | CVE-2020-5410Spring Cloud Config Directory Traversal | VMware Tanzu Spring Cloud Configuration (Config) Server | Patch this weekMetasploit module; EPSS 0.96 | 0.96 | ||
| 483 | CVE-2020-25223Remote Code Execution | Sophos SG UTM | Patch this weekMetasploit module; EPSS 0.97 | 0.97 | ||
| 484 | CVE-2021-42237Remote Command Execution | Sitecore XP | Patch this weekRansomware use; Metasploit module; EPSS 0.98 | 0.98 | ||
| 485 | CVE-2022-26318Arbitrary Code Execution | WatchGuard Firebox and XTM Appliances | Patch this weekMetasploit module; EPSS 0.78 | 0.78 | ||
| 486 | CVE-2022-20699Small Business RV Series Routers Stack-based Buffer Overflow | Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers | Patch this weekMetasploit module; EPSS 0.72 | 0.72 | ||
| 487 | CVE-2015-1635Remote Code Execution | Microsoft HTTP.sys | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 488 | CVE-2017-8464Shell (.lnk) Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.90 | 0.90 | ||
| 489 | CVE-2018-1000861Deserialization of Untrusted Data | Jenkins Jenkins Stapler Web Framework | Patch this weekMetasploit module; EPSS 0.98 | 0.98 | ||
| 490 | CVE-2020-0796Remote Code Execution | Microsoft SMBv3 | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 491 | CVE-2021-36934SAM Local Privilege Escalation | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.67 | 0.67 | ||
| 492 | CVE-2022-21882Privilege Escalation | Microsoft Win32k | Patch this weekRansomware use; Metasploit module; EPSS 0.59 | 0.59 | ||
| 493 | CVE-2017-5689Privilege Escalation | Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability | Patch this weekMetasploit module; EPSS 0.92 | 0.92 | ||
| 494 | CVE-2020-5722Networks UCM6200 Series SQL Injection | Grandstream UCM6200 | Patch this weekMetasploit module; EPSS 0.84 | 0.84 | ||
| 495 | CVE-2020-11978Command Injection | Apache Airflow | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 496 | CVE-2020-13927Authentication Bypass | Apache Airflow's Experimental API | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 497 | CVE-2021-21975Server Side Request Forgery in vRealize Operations Manager API | VMware vRealize Operations Manager API | Patch this weekRansomware use; Metasploit module; EPSS 0.78 | 0.78 | ||
| 498 | CVE-2021-25296OS Command Injection | Nagios Nagios XI | Patch this weekMetasploit module; EPSS 0.72 | 0.72 | ||
| 499 | CVE-2021-25297OS Command Injection | Nagios Nagios XI | Patch this weekMetasploit module; EPSS 0.57 | 0.57 | ||
| 500 | CVE-2021-25298OS Command Injection | Nagios Nagios XI | Patch this weekMetasploit module; EPSS 0.75 | 0.75 |