By publication date
Exploited and new serious CVEs: April 2018
107 records · 3 KEV. In publication order.
Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.
Month boundaries are UTC, the same rule as the publication date on each record page.
Page 2 of 2
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
60This week | CVE-2018-1335Weaponized | From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands intapache · tika | High8.1 | — | 93.5% | Apr 25, 2018 |
50Plan | CVE-2018-1418Weaponized | IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution.ibm · qradar security information and event manager · CWE-287 | High8.8 | — | 50.7% | Apr 26, 2018 |
35Monitor | CVE-2018-7669Proof of concept | An issue was discovered in Sitecore Sitecore.NET 8.1 rev.sitecore · sitecore.net · CWE-22 | High7.5 | — | 16.9% | Apr 27, 2018 |
31Monitor | CVE-2018-10517Proof of concept | In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerabilitcmsmadesimple · cms made simple · CWE-94 | High7.2 | — | 11.5% | Apr 27, 2018 |
43Plan | CVE-2018-9845Proof of concept | Etherpad Lite before 1.6.4 is exploitable for admin access.etherpad · etherpad lite · CWE-178 | Critical9.8 | — | 12.7% | Apr 29, 2018 |
38Monitor | CVE-2018-10553No exploit | An issue was discovered in Nagios XI 5.4.13.nagios · nagios xi · CWE-22 | Medium6.5 | — | 38.3% | Apr 29, 2018 |
37Monitor | CVE-2018-5234Proof of concept | The Norton Core router prior to v237 may be susceptible to a command injection exploit.symantec · norton core firmware | High8.0 | — | 15.2% | Apr 30, 2018 |
- CVE-2018-133560This week
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands int
HighCVSS 8.1WeaponizedEPSS 93%apache · tikaApr 25, 2018
- CVE-2018-141850Plan
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution.
HighCVSS 8.8WeaponizedEPSS 50%ibm · qradar security information and event managerApr 26, 2018
- CVE-2018-766935Monitor
An issue was discovered in Sitecore Sitecore.NET 8.1 rev.
HighCVSS 7.5Proof of conceptEPSS 16%sitecore · sitecore.netApr 27, 2018
- CVE-2018-1051731Monitor
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerabilit
HighCVSS 7.2Proof of conceptEPSS 11%cmsmadesimple · cms made simpleApr 27, 2018
- CVE-2018-984543Plan
Etherpad Lite before 1.6.4 is exploitable for admin access.
CriticalCVSS 9.8Proof of conceptEPSS 12%etherpad · etherpad liteApr 29, 2018
- CVE-2018-1055338Monitor
An issue was discovered in Nagios XI 5.4.13.
MediumCVSS 6.5No exploitEPSS 38%nagios · nagios xiApr 29, 2018
- CVE-2018-523437Monitor
The Norton Core router prior to v237 may be susceptible to a command injection exploit.
HighCVSS 8.0Proof of conceptEPSS 15%symantec · norton core firmwareApr 30, 2018