By publication date
Exploited and new serious CVEs: May 2023
109 records · 8 KEV. In publication order.
Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.
Month boundaries are UTC, the same rule as the publication date on each record page.
Page 2 of 2
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
42Plan | CVE-2023-2936No exploit | Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted google · chrome · CWE-843 | High8.8 | — | 23.0% | May 30, 2023 |
39Monitor | CVE-2023-34220No exploit | In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possiblejetbrains · teamcity · CWE-79 | Medium5.4 | — | 61.4% | May 31, 2023 |
39Monitor | CVE-2023-34225No exploit | In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possiblejetbrains · teamcity · CWE-79 | Medium5.4 | — | 60.7% | May 31, 2023 |
44Plan | CVE-2022-35748No exploit | HTTP.sys Denial of Service Vulnerabilitymicrosoft · windows server 2012 | High7.5 | — | 47.2% | May 31, 2023 |
34Monitor | CVE-2022-35756No exploit | Windows Kerberos Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 | High7.8 | — | 11.3% | May 31, 2023 |
48Plan | CVE-2023-33735No exploit | D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter idlink · dir-846 firmware | Critical9.8 | — | 31.5% | May 31, 2023 |
37Monitor | CVE-2022-35742No exploit | Microsoft Outlook Denial of Service Vulnerabilitymicrosoft · 365 apps | High7.5 | — | 22.2% | May 31, 2023 |
38Monitor | CVE-2023-28651No exploit | Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3.contec · conprosys hmi system · CWE-79 | Medium4.8 | — | 62.4% | May 31, 2023 |
40Plan | CVE-2023-29154No exploit | SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3.contec · conprosys hmi system · CWE-89 | High7.2 | — | 41.4% | May 31, 2023 |
- CVE-2023-293642Plan
Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted
HighCVSS 8.8No exploitEPSS 23%google · chromeMay 30, 2023
- CVE-2023-3422039Monitor
In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible
MediumCVSS 5.4No exploitEPSS 61%jetbrains · teamcityMay 31, 2023
- CVE-2023-3422539Monitor
In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible
MediumCVSS 5.4No exploitEPSS 60%jetbrains · teamcityMay 31, 2023
- CVE-2022-3574844Plan
HTTP.sys Denial of Service Vulnerability
HighCVSS 7.5No exploitEPSS 47%microsoft · windows server 2012May 31, 2023
- CVE-2022-3575634Monitor
Windows Kerberos Elevation of Privilege Vulnerability
HighCVSS 7.8No exploitEPSS 11%microsoft · windows 10 1507May 31, 2023
- CVE-2023-3373548Plan
D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter i
CriticalCVSS 9.8No exploitEPSS 31%dlink · dir-846 firmwareMay 31, 2023
- CVE-2022-3574237Monitor
Microsoft Outlook Denial of Service Vulnerability
HighCVSS 7.5No exploitEPSS 22%microsoft · 365 appsMay 31, 2023
- CVE-2023-2865138Monitor
Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3.
MediumCVSS 4.8No exploitEPSS 62%contec · conprosys hmi systemMay 31, 2023
- CVE-2023-2915440Plan
SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3.
HighCVSS 7.2No exploitEPSS 41%contec · conprosys hmi systemMay 31, 2023