Total
422082 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-28158 | 1 Apache | 1 Archiva | 2026-06-17 | N/A | 6.5 MEDIUM |
| Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user. | |||||
| CVE-2023-28155 | 1 Request Project | 1 Request | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2023-28154 | 1 Webpack.js | 1 Webpack | 2026-06-17 | N/A | 9.8 CRITICAL |
| Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object. | |||||
| CVE-2023-28153 | 1 Kiddoware | 1 Kiddoware | 2026-06-17 | N/A | 6.4 MEDIUM |
| An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child can remove all restrictions temporarily without the parents noticing by rebooting into Android Safe Mode and disabling the "Display over other apps" permission. | |||||
| CVE-2023-28152 | 1 Independentsoft | 1 Jword | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. | |||||
| CVE-2023-28151 | 1 Independentsoft | 1 Jspreadsheet | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. | |||||
| CVE-2023-28150 | 1 Independentsoft | 1 Jodf | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file. | |||||
| CVE-2023-28149 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 05.45.39, 5.5 before 05.53.39, and 5.6 before 05.60.39 that could allow an attacker to modify UEFI variables. | |||||
| CVE-2023-28147 | 1 Arm | 4 Avalon Gpu Kernel Driver, Bifrost Gpu Kernel Driver, Midgard Gpu Kernel Driver and 1 more | 2026-06-17 | N/A | 5.5 MEDIUM |
| An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r29p0 through r32p0, Bifrost r17p0 through r42p0 before r43p0, Valhall r19p0 through r42p0 before r43p0, and Arm's GPU Architecture Gen5 r41p0 through r42p0 before r43p0. | |||||
| CVE-2023-28144 | 1 Kdab | 1 Hotspot | 2026-06-17 | N/A | 7.0 HIGH |
| KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving symlinks and elevate_perf_privileges.sh chown calls. | |||||
| CVE-2023-28143 | 2 Apple, Qualys | 2 Mac Os X, Cloud Agent | 2026-06-17 | N/A | 6.7 MEDIUM |
| Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only on older macOSX (macOS 10.15 and older) versions. Attackers may exploit incorrect file permissions to give them ROOT command execution privileges on the host. During the install of the PKG, a step in the process involves extracting the package and copying files to several directories. Attackers may gain writable access to files during the install of PKG when extraction of the package and copying files to several directories, enabling a local escalation of privilege. | |||||
| CVE-2023-28142 | 1 Qualys | 1 Cloud Agent | 2026-06-17 | N/A | 6.7 MEDIUM |
| A Race Condition exists in the Qualys Cloud Agent for Windows platform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers to escalate privileges limited on the local machine during uninstallation of the Qualys Cloud Agent for Windows. Attackers may gain SYSTEM level privileges on that asset to run arbitrary commands. At the time of this disclosure, versions before 4.0 are classified as End of Life. | |||||
| CVE-2023-28141 | 1 Qualys | 1 Cloud Agent | 2026-06-17 | N/A | 6.7 MEDIUM |
| An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31. Attackers may write files to arbitrary locations via a local attack vector. This allows attackers to assume the privileges of the process, and they may delete or otherwise on unauthorized files, allowing for the potential modification or deletion of sensitive files limited only to that specific directory/file object. This vulnerability is bounded to the time of installation/uninstallation and can only be exploited locally. At the time of this disclosure, versions before 4.0 are classified as End of Life. | |||||
| CVE-2023-28140 | 1 Qualys | 1 Cloud Agent | 2026-06-17 | N/A | 6.7 MEDIUM |
| An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a malicious copy of a Dependency Link Library (DLL) via a local attack vector instead of the DLL that the application was expecting, when processes are running with escalated privileges. This vulnerability is bounded only to the time of uninstallation and can only be exploited locally. At the time of this disclosure, versions before 4.0 are classified as End of Life. | |||||
| CVE-2023-28134 | 1 Checkpoint | 1 Endpoint Security | 2026-06-17 | N/A | 7.8 HIGH |
| Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. | |||||
| CVE-2023-28133 | 1 Checkpoint | 1 Endpoint Security | 2026-06-17 | N/A | 7.8 HIGH |
| Local privilege escalation in Check Point Endpoint Security Client (version E87.30) via crafted OpenSSL configuration file | |||||
| CVE-2023-28131 | 1 Expo | 1 Expo Software Development Kit | 2026-06-17 | N/A | 9.6 CRITICAL |
| A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc). | |||||
| CVE-2023-28130 | 1 Checkpoint | 1 Gaia Portal | 2026-06-17 | N/A | 7.2 HIGH |
| Local user may lead to privilege escalation using Gaia Portal hostnames page. | |||||
| CVE-2023-28129 | 1 Ivanti | 1 Desktop \& Server Management | 2026-06-17 | N/A | 7.8 HIGH |
| DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user. | |||||
| CVE-2023-28128 | 1 Ivanti | 1 Avalanche | 2026-06-17 | N/A | 7.2 HIGH |
| An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. | |||||