Flaws added in May 2023
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in May 2023. For the newest, see Exploited flaws.
In May 2023, CISA added 19 flaws to its list of vulnerabilities being used in attacks, 9 of them in things people have at home; 1 has been used by ransomware gangs. Most came from Apple (3), Cisco (2) and Apache (2).[1]
Most let an attacker take over the product, running their own code or taking full control. It was the third most CISA added in any month of 2023.
List of flaws
Every flaw CISA added in May 2023, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-28771At home |
Zyxel Multiple Firewalls. Attackers can run commands on Zyxel Multiple Firewalls from anywhere, without logging in. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-2868At work |
Barracuda Networks Email Security Gateway (ESG) Appliance. Attackers can run commands on Barracuda Networks Email Security Gateway (ESG) Appliance. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-32409At home |
Apple devices. Attackers can get past a security protection in Apple devices. | At home |
CVE-2023-32373At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2023-28204At home |
Apple devices. Attackers can corrupt memory in Apple devices, which they use to take it over. | At home |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-21492At home |
Samsung Mobile Devices. Attackers can read information from Samsung Mobile Devices that should be private. | At home |
CVE-2016-6415At work |
Cisco IOS, IOS XR, and IOS XE. Attackers can read information from Cisco IOS, IOS XR, and IOS XE that should be private. | At work |
CVE-2004-1464At work |
Cisco IOS. Attackers can crash Cisco IOS or stop it working. | At work |
7 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-25717At home |
Ruckus Wireless products. Attackers can run their own code on Ruckus Wireless products from anywhere, without logging in. | At home |
CVE-2021-3560At work |
Red Hat Polkit. Someone who already has a foothold can use Red Hat Polkit to take full control of the machine. | At work |
CVE-2016-8735At work |
Apache Tomcat. Attackers can run their own code on Apache Tomcat. | At work |
CVE-2016-3427At home |
Oracle Java SE and JRockit. Attackers are using a flaw in Oracle Java SE and JRockit that its maker hasn't described in detail. | At home |
CVE-2015-5317At work |
Jenkins User Interface (UI). Attackers can read information from Jenkins User Interface (UI) that should be private. | At work |
CVE-2014-0196At work |
Linux Kernel. Someone who already has a way in can corrupt memory in Linux Kernel to take more control. | At work |
CVE-2010-3904At work |
Linux Kernel. Attackers are using a flaw in Linux Kernel. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-29336At home |
Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine. | At home |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-21839At work |
Oracle WebLogic Server. Attackers are using a flaw in Oracle WebLogic Server that its maker hasn't described in detail. | At work |
CVE-2023-1389At home |
TP-Link Archer AX21. Attackers can run their own code on TP-Link Archer AX21 from anywhere, without logging in. | At home |
CVE-2021-45046† Used in ransomwareAt work |
Apache Log4j2. Attackers can run their own code on Apache Log4j2. | At work |
Companies
The flaws were in 13 companies’ products; the most were in Apple’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Apple | 3 | – |
| Apache | 2 | 1 |
| Cisco | 2 | – |
| Linux | 2 | – |
| Oracle | 2 | – |
| Barracuda Networks | 1 | – |
| Jenkins | 1 | – |
| Microsoft | 1 | – |
| Red Hat | 1 | – |
| Ruckus Wireless | 1 | – |
| Samsung | 1 | – |
| TP-Link | 1 | – |
| Zyxel | 1 | – |
Other months
Every month since CISA started the list; May 2023 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.