Flaws added in November 2023
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in November 2023. For the newest, see Exploited flaws.
In November 2023, CISA added 18 flaws to its list of vulnerabilities being used in attacks, 5 of them in things people have at home; 3 have been used by ransomware gangs. Most came from Juniper (5), Microsoft (4) and Google (1).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in November 2023, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-6345At home |
Chrome and other Chromium browsers. Attackers can get past a security protection in Chrome and other Chromium browsers. | At home |
CVE-2023-49103At work |
ownCloud graphapi. Attackers can read information from ownCloud graphapi that should be private. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-4911At work |
GNU C Library. Someone who already has a way in can use GNU C Library to run their own code. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-36584At home |
Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. | At home |
CVE-2023-1671At work |
Sophos Web Appliance. Attackers can run their own code on Sophos Web Appliance from anywhere, without logging in. | At work |
CVE-2020-2551At work |
Oracle Fusion Middleware. Attackers are using a flaw in Oracle Fusion Middleware that its maker hasn't described in detail. | At work |
3 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-36036At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2023-36033At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2023-36025At home |
Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. | At home |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-47246† Used in ransomwareAt work |
SysAid Server. Attackers can run their own code on SysAid Server. | At work |
CVE-2023-36851At work |
Juniper Junos OS. Attackers can upload a file to Juniper Junos OS from anywhere, without logging in and make it run. | At work |
CVE-2023-36847At work |
Juniper Junos OS. Attackers can upload a file to Juniper Junos OS from anywhere, without logging in and make it run. | At work |
CVE-2023-36846At work |
Juniper Junos OS. Attackers can upload a file to Juniper Junos OS from anywhere, without logging in and make it run. | At work |
CVE-2023-36845At work |
Juniper Junos OS. Attackers can run their own code on Juniper Junos OS from anywhere, without logging in. | At work |
CVE-2023-36844At work |
Juniper Junos OS. Attackers are using a flaw in Juniper Junos OS. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-29552At work |
IETF Service Location Protocol (SLP). Attackers can make something fake look genuine in IETF Service Location Protocol (SLP). | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-22518† Used in ransomwareAt work |
Atlassian Confluence Data Center and Server. Attackers are using a flaw in Atlassian Confluence Data Center and Server. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2023-46604† Used in ransomwareAt work |
Apache ActiveMQ. Attackers can run their own code on Apache ActiveMQ. | At work |
Companies
The flaws were in eleven companies’ products; the most were in Juniper’s (5).
| Company | Flaws | Ransomware |
|---|---|---|
| Juniper | 5 | – |
| Microsoft | 4 | – |
| Apache | 1 | 1 |
| Atlassian | 1 | 1 |
| GNU | 1 | – |
| 1 | – | |
| IETF | 1 | – |
| Oracle | 1 | – |
| ownCloud | 1 | – |
| Sophos | 1 | – |
| SysAid | 1 | 1 |
Other months
Every month since CISA started the list; November 2023 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.