Jul 14, 2023 Cyber Threat Intelligence

Track daily vulnerability activity, KEV additions, public exploits, critical disclosures, and EPSS risk shifts.

Daily summary

  • 5 new critical disclosures — review patch status on exposed services.

Top threats today

Three highest-priority changes — analyst brief, not a CVE dump.

Critical exposure

CVE-2023-37462 Xwiki RCE

  • CVSS 9.9
  • Remote code execution exposure

New critical Xwiki RCE (CVSS 9.9) — fresh disclosure window; early internet scanning often precedes mature exploit chains.

Critical exposure

CVE-2023-35802 Extremenetworks Iq Engine RCE

  • CVSS 9.8
  • Remote code execution exposure

New critical Extremenetworks Iq Engine RCE (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.

Critical exposure

CVE-2023-37793 Wayos Fbm-291w Firmware Buffer Overflow

  • CVSS 9.8

New critical Wayos Fbm-291w Firmware Buffer Overflow (CVSS 9.8) — fresh disclosure window; early internet scanning often precedes mature exploit chains.

Active exploitation

CISA KEV — confirmed in-the-wild exploitation.

Nothing flagged in this category for this digest.

View KEV additions

Exploit & PoC activity

Nothing flagged in this category for this digest.

View new exploit links

Exploitation dynamics

Nothing flagged in this category for this digest.

See EPSS increases

New critical disclosures

CVE-2023-35802 CVSS 9.8

IQ Engine before 10.6r1 on Extreme Network AP devices has a Buffer Overflow in the implementation of the CAPWAP protocol that may be expl...

CVE-2023-37462 CVSS 9.9

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.

CVE-2023-37793 CVSS 9.8

WAYOS FBM-291W 19.09.11V was discovered to contain a buffer overflow via the component /upgrade_filter.asp.

CVE-2023-37794 CVSS 9.8

WAYOS FBM-291W 19.09.11V was discovered to contain a command injection vulnerability via the component /upgrade_filter.asp.

CVE-2023-38336 CVSS 9.8

netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-...

View critical disclosures

cvelogic Threat Intelligence