# Vulnerabilities published in 2023 - [CVE-2023-26156](https://insights.sbomify.com/CVE-2023-26156/): chromedriver Command Injection vulnerability (medium 5.6) - [CVE-2023-26155](https://insights.sbomify.com/CVE-2023-26155/): node-qpdf vulnerable to command injection (high 7.3) - [CVE-2023-26154](https://insights.sbomify.com/CVE-2023-26154/): pubnub Insufficient Entropy vulnerability (medium 5.9) - [CVE-2023-26153](https://insights.sbomify.com/CVE-2023-26153/): geokit-rails Command Injection vulnerability (high 8.3) - [CVE-2023-26152](https://insights.sbomify.com/CVE-2023-26152/): static-server Path Traversal vulnerability (high 7.5) - [CVE-2023-26151](https://insights.sbomify.com/CVE-2023-26151/): asyncua vulnerable to denial of service via infinite loop (medium 5.3) - [CVE-2023-26150](https://insights.sbomify.com/CVE-2023-26150/): asyncua Improper Authentication vulnerability (medium 6.5) - [CVE-2023-2615](https://insights.sbomify.com/CVE-2023-2615/): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (medium 6.8) - [CVE-2023-26149](https://insights.sbomify.com/CVE-2023-26149/): quill-mention Cross-site Scripting vulnerability (medium 6.1) - [CVE-2023-26148](https://insights.sbomify.com/CVE-2023-26148/): Other in ithewei/libhv (medium 5.4) - [CVE-2023-26147](https://insights.sbomify.com/CVE-2023-26147/): Cross-site scripting in ithewei/libhv (medium 5.3) - [CVE-2023-26146](https://insights.sbomify.com/CVE-2023-26146/): Cross-site scripting in ithewei/libhv (medium 6.1) - [CVE-2023-26145](https://insights.sbomify.com/CVE-2023-26145/): pydash Command Injection vulnerability (high 7.4) - [CVE-2023-26144](https://insights.sbomify.com/CVE-2023-26144/): graphql Uncontrolled Resource Consumption vulnerability (medium 5.3) - [CVE-2023-26143](https://insights.sbomify.com/CVE-2023-26143/): blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API (medium 6.5) - [CVE-2023-26142](https://insights.sbomify.com/CVE-2023-26142/): Other in Crow (medium 6.5) - [CVE-2023-26141](https://insights.sbomify.com/CVE-2023-26141/): sidekiq Denial of Service vulnerability (high 7.5) - [CVE-2023-26140](https://insights.sbomify.com/CVE-2023-26140/): @excalidraw/excalidraw Cross-site Scripting vulnerability (medium 6.1) - [CVE-2023-2614](https://insights.sbomify.com/CVE-2023-2614/): Cross-site Scripting (XSS) - DOM in pimcore/pimcore (medium 6.8) - [CVE-2023-26139](https://insights.sbomify.com/CVE-2023-26139/): underscore-keypath vulnerable to Prototype Pollution (high 7.5) - [CVE-2023-26138](https://insights.sbomify.com/CVE-2023-26138/): Other in drogonframework/drogon (medium 5.4) - [CVE-2023-26137](https://insights.sbomify.com/CVE-2023-26137/): Other in drogonframework/drogon (high 7.2) - [CVE-2023-26136](https://insights.sbomify.com/CVE-2023-26136/): tough-cookie Prototype Pollution vulnerability (medium 6.5) - [CVE-2023-26135](https://insights.sbomify.com/CVE-2023-26135/): flatnest Prototype Pollution vulnerability (high 7.3) - [CVE-2023-26134](https://insights.sbomify.com/CVE-2023-26134/): git-commit-info vulnerable to Command Injection (critical 9.8) - [CVE-2023-26133](https://insights.sbomify.com/CVE-2023-26133/): progressbar.js vulnerable to Prototype Pollution (high 8.2) - [CVE-2023-26132](https://insights.sbomify.com/CVE-2023-26132/): dottie vulnerable to Prototype Pollution (high 7.5) - [CVE-2023-26131](https://insights.sbomify.com/CVE-2023-26131/): Algernon engine and themes vulnerable to Cross-site Scripting (medium 5.4) - [CVE-2023-26130](https://insights.sbomify.com/CVE-2023-26130/): Other in yhirose/cpp-httplib (high 7.5) - [CVE-2023-26129](https://insights.sbomify.com/CVE-2023-26129/): bwm-ng vulnerable to command injection (high 8.4) - [CVE-2023-26128](https://insights.sbomify.com/CVE-2023-26128/): keep-module-latest vulnerable to Command Injection due to missing input sanitization (high 8.4) - [CVE-2023-26127](https://insights.sbomify.com/CVE-2023-26127/): n158 vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function (high 7.8) - [CVE-2023-26126](https://insights.sbomify.com/CVE-2023-26126/): m.static Directory Traversal vulnerability (high 7.5) - [CVE-2023-26125](https://insights.sbomify.com/CVE-2023-26125/): Improper input validation in github.com/gin-gonic/gin (medium 5.6) - [CVE-2023-26123](https://insights.sbomify.com/CVE-2023-26123/): Cross-site scripting in raysan5/raylib (medium 6.1) - [CVE-2023-26122](https://insights.sbomify.com/CVE-2023-26122/): safe-eval vulnerable to Sandbox Bypass due to improper input sanitization (high 8.8) - [CVE-2023-26121](https://insights.sbomify.com/CVE-2023-26121/): safe-eval vulnerable to Prototype Pollution via the safeEval function (high 7.5) - [CVE-2023-26120](https://insights.sbomify.com/CVE-2023-26120/): XXL-JOB vulnerable to Cross-site Scripting (medium 5.4) - [CVE-2023-2612](https://insights.sbomify.com/CVE-2023-2612/): shiftfs lock unbalance in Ubuntu-specific kernels (medium 4.4) - [CVE-2023-26119](https://insights.sbomify.com/CVE-2023-26119/): HtmlUnit Code Injection vulnerability (critical 9.8) - [CVE-2023-26118](https://insights.sbomify.com/CVE-2023-26118/): angular vulnerable to regular expression denial of service via the element (medium 5.3) - [CVE-2023-26117](https://insights.sbomify.com/CVE-2023-26117/): angular vulnerable to regular expression denial of service via the $resource service (medium 5.3) - [CVE-2023-26116](https://insights.sbomify.com/CVE-2023-26116/): angular vulnerable to regular expression denial of service via the angular.copy() utility (medium 5.3) - [CVE-2023-26115](https://insights.sbomify.com/CVE-2023-26115/): word-wrap vulnerable to Regular Expression Denial of Service (medium 5.3) - [CVE-2023-26114](https://insights.sbomify.com/CVE-2023-26114/): code-server vulnerable to Missing Origin Validation in WebSockets (high 8.2) - [CVE-2023-26113](https://insights.sbomify.com/CVE-2023-26113/): Collection.js vulnerable to Prototype Pollution (high 7.5) - [CVE-2023-26112](https://insights.sbomify.com/CVE-2023-26112/): configobj ReDoS exploitable by developer using values in a server-side configuration file (low 3.7) - [CVE-2023-26111](https://insights.sbomify.com/CVE-2023-26111/): node-static and @nubosoftware/node-static vulnerable to Directory Traversal (high 7.5) - [CVE-2023-26110](https://insights.sbomify.com/CVE-2023-26110/): node-bluetooth is vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation (high 7.3) - [CVE-2023-2611](https://insights.sbomify.com/CVE-2023-2611/): Advantech R-SeeNet Use of Hard-coded Credentials (critical 9.8) - [CVE-2023-26109](https://insights.sbomify.com/CVE-2023-26109/): node-bluetooth-serial-port is vulnerable to Buffer Overflow via the findSerialPortChannel (high 7.3) - [CVE-2023-26108](https://insights.sbomify.com/CVE-2023-26108/): @nestjs/core vulnerable to Information Exposure via StreamableFile pipe (low 3.7) - [CVE-2023-26107](https://insights.sbomify.com/CVE-2023-26107/): SketchSVG Arbitrary Code Injection vulnerability (medium 6.9) - [CVE-2023-26106](https://insights.sbomify.com/CVE-2023-26106/): dot-lens vulnerable to Prototype Pollution (high 7.5) - [CVE-2023-26105](https://insights.sbomify.com/CVE-2023-26105/): mde utilities contains Prototype Pollution (high 7.5) - [CVE-2023-26104](https://insights.sbomify.com/CVE-2023-26104/): Denial of Service vulnerability in lite-web-server (high 7.5) - [CVE-2023-26103](https://insights.sbomify.com/CVE-2023-26103/): Regular Expression Denial of Service in Deno.upgradeWebSocket API (medium 5.3) - [CVE-2023-26102](https://insights.sbomify.com/CVE-2023-26102/): rangy vulnerable to Prototype Pollution (high 7.5) - [CVE-2023-26101](https://insights.sbomify.com/CVE-2023-26101/): Path traversal in progress:flowmon packet investigator (high 7.5) - [CVE-2023-26100](https://insights.sbomify.com/CVE-2023-26100/): Cross-site scripting in progress:flowmon os (medium 6.1) - [CVE-2023-2610](https://insights.sbomify.com/CVE-2023-2610/): Integer Overflow or Wraparound in vim/vim (high 7.8) - [CVE-2023-26099](https://insights.sbomify.com/CVE-2023-26099/): Missing authorization in telindus:apsal (medium 4.4) - [CVE-2023-26098](https://insights.sbomify.com/CVE-2023-26098/): File upload in telindus:apsal (high 8.2) - [CVE-2023-26097](https://insights.sbomify.com/CVE-2023-26097/): Missing authorization in telindus:apsal (high 8.4) - [CVE-2023-26095](https://insights.sbomify.com/CVE-2023-26095/): Denial of service in stormshield:stormshield network security (high 7.5) - [CVE-2023-26093](https://insights.sbomify.com/CVE-2023-26093/): SQL injection in puzzle:liima (critical 9.8) - [CVE-2023-26092](https://insights.sbomify.com/CVE-2023-26092/): Code injection in puzzle:liima (critical 9.8) - [CVE-2023-26091](https://insights.sbomify.com/CVE-2023-26091/): frp_form_answers allows Cross-site Scripting (medium 6.1) - [CVE-2023-2609](https://insights.sbomify.com/CVE-2023-2609/): NULL Pointer Dereference in vim/vim (high 7.8) - [CVE-2023-26089](https://insights.sbomify.com/CVE-2023-26089/): Hardcoded credentials in echa.europa:iuclid (critical 9.8) - [CVE-2023-26088](https://insights.sbomify.com/CVE-2023-26088/): Path traversal in malwarebytes:malwarebytes (high 7.8) - [CVE-2023-26085](https://insights.sbomify.com/CVE-2023-26085/): Memory corruption in arm:nn android neural networks driver (high 7.8) - [CVE-2023-26084](https://insights.sbomify.com/CVE-2023-26084/): Weak cryptography in arm:aarch64cryptolib (low 3.7) - [CVE-2023-26083](https://insights.sbomify.com/CVE-2023-26083/): Arm Mali GPU Kernel Driver Information Disclosure (low 3.3, exploited in the wild) - [CVE-2023-26081](https://insights.sbomify.com/CVE-2023-26081/): Security feature bypass in fedoraproject:fedora (high 7.5) - [CVE-2023-2608](https://insights.sbomify.com/CVE-2023-2608/): Multiple Page Generator Plugin <= 3.3.17 - Cross-Site Request Forgery to SQL Injection (low 3.1) - [CVE-2023-26078](https://insights.sbomify.com/CVE-2023-26078/): Privilege escalation in atera:atera (high 7.8) - [CVE-2023-26077](https://insights.sbomify.com/CVE-2023-26077/): Misconfiguration in atera:atera (high 7.8) - [CVE-2023-26076](https://insights.sbomify.com/CVE-2023-26076/): Memory corruption in samsung:exynos 1280 firmware (high 7.6) - [CVE-2023-26075](https://insights.sbomify.com/CVE-2023-26075/): Memory corruption in samsung:exynos 1080 firmware (high 7.6) - [CVE-2023-26074](https://insights.sbomify.com/CVE-2023-26074/): Memory corruption in samsung:exynos 1080 firmware (high 7.6) - [CVE-2023-26073](https://insights.sbomify.com/CVE-2023-26073/): Memory corruption in samsung:exynos 1080 firmware (high 7.6) - [CVE-2023-26072](https://insights.sbomify.com/CVE-2023-26072/): Memory corruption in samsung:exynos 1080 firmware (high 7.6) - [CVE-2023-26071](https://insights.sbomify.com/CVE-2023-26071/): Information disclosure in harpaitalia:mcuboict (high 7.5) - [CVE-2023-26070](https://insights.sbomify.com/CVE-2023-26070/): Other in lexmark:cslbl firmware (critical 9.8) - [CVE-2023-2607](https://insights.sbomify.com/CVE-2023-2607/): Multiple Page Generator Plugin <= 3.3.17 - Authenticated (Administrator+) SQL Injection (high 7.2) - [CVE-2023-26069](https://insights.sbomify.com/CVE-2023-26069/): Other in lexmark:cslbl firmware (critical 9.8) - [CVE-2023-26068](https://insights.sbomify.com/CVE-2023-26068/): Other in lexmark:cslbl firmware (critical 9.8) - [CVE-2023-26067](https://insights.sbomify.com/CVE-2023-26067/): Other in lexmark:cslbl firmware (high 8.1) - [CVE-2023-26066](https://insights.sbomify.com/CVE-2023-26066/): Memory corruption in lexmark:cslbl firmware (critical 9.8) - [CVE-2023-26065](https://insights.sbomify.com/CVE-2023-26065/): Integer overflow in lexmark:cslbl firmware (critical 9.8) - [CVE-2023-26064](https://insights.sbomify.com/CVE-2023-26064/): Memory corruption in lexmark:cslbl firmware (critical 9.8) - [CVE-2023-26063](https://insights.sbomify.com/CVE-2023-26063/): Memory corruption in lexmark:cslbl firmware (critical 9.8) - [CVE-2023-26062](https://insights.sbomify.com/CVE-2023-26062/): Privilege escalation in nokia:web element manager (high 7.0) - [CVE-2023-26061](https://insights.sbomify.com/CVE-2023-26061/): Cross-site scripting in nokia:netact (medium 6.8) - [CVE-2023-26060](https://insights.sbomify.com/CVE-2023-26060/): Code injection in nokia:netact (medium 6.8) - [CVE-2023-2606](https://insights.sbomify.com/CVE-2023-2606/): WP Brutal AI < 2.06 - Admin+ Stored XSS (medium 4.8) - [CVE-2023-26059](https://insights.sbomify.com/CVE-2023-26059/): Cross-site scripting in nokia:netact (medium 6.8) - [CVE-2023-26058](https://insights.sbomify.com/CVE-2023-26058/): XML external entity in nokia:netact (medium 6.5) - [CVE-2023-26057](https://insights.sbomify.com/CVE-2023-26057/): XML external entity in nokia:netact (medium 6.5) --- From sbomify Insights: https://insights.sbomify.com/years/2023/page/359/