by Artie Kaye

Here’s an updated list of the CISA active exploits that should be addressed as soon as possible.  The list may contain issues that were patched in previous years.  These vulnerabilities remain open and exploitable because the devices in question are not updated and thus remain insecure.  While this list is mandatory only for government agencies and certain organizations, it is good practice to address the items which are listed to keep your information safe.

Company	CVE	Platform	Details
Apple	CVE-2023-32434	iOS	iOS 15.7.7 and iPadOS 15.7.7 https://support.apple.com/en-us/HT213811 iOS 16.5.1 and iPadOS 16.5.1 https://support.apple.com/en-us/HT213814
		macOS	macOS Big Sur 11.7.8 https://support.apple.com/en-us/HT213809 macOS Monterey 12.6.7 https://support.apple.com/en-us/HT213810 macOS Ventura 13.4.1 https://support.apple.com/en-us/HT213813
		watchOS	watchOS 8.8.1 https://support.apple.com/en-us/HT213808 watchOS 9.5.2 https://support.apple.com/en-us/HT213812
	CVE-2023-32435	iOS	iOS 15.7.7 and iPadOS 15.7.7 https://support.apple.com/en-us/HT213811 iOS 16.4 and iPadOS 16.4 https://support.apple.com/en-us/HT213676
		macOS	macOS Ventura 13.3 https://support.apple.com/en-us/HT213670
		Safari	Safari 16.4 https://support.apple.com/en-us/HT213671
	CVE-2023-32439	iOS	iOS 15.7.7 and iPadOS 15.7.7 https://support.apple.com/en-us/HT213811 iOS 16.5.1 and iPadOS 16.5.1 https://support.apple.com/en-us/HT213814
		macOS	macOS Ventura 13.4.1 https://support.apple.com/en-us/HT213813
		Safari	Safari 16.5.1 https://support.apple.com/en-us/HT213816
D-Link	CVE-2019-17621	DIR-859 Router	https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147
	CVE-2019-20500	DWL-2600AP Access Point	https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113
Fortinet	CVE-2023-27997	FortiOS and FortiProxy SSL-VPN	https://www.fortiguard.com/psirt/FG-IR-23-097
Google	CVE-2023-3079	Chromium V8 Engine	https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html
Microsoft	CVE-2016-0165	Win32k	https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039
Mozilla	CVE-2016-9079	Firefox, Firefox ESR, Thunderbird	https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079
Roundcube	CVE-2020-35730	Roundcube Webmail	https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13
	CVE-2020-12641		https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10
	CVE-2021-44026		https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released
Samsung	CVE-2021-25487 CVE-2021-25489	Mobile Devices	https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10
	CVE-2021-25394 CVE-2021-25395		https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5
	CVE-2021-25371 CVE-2021-25372		https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=3
			VMware Tools https://www.vmware.com/security/advisories/VMSA-2023-0013.html CVE-2023-20867 Aria Operations for Networks https://www.vmware.com/security/advisories/VMSA-2023-0012.html CVE-2023-20887
VMware	CVE-2023-20867	Tools	https://www.vmware.com/security/advisories/VMSA-2023-0013.html
	CVE-2023-20887	Aria Operations for Networks	https://www.vmware.com/security/advisories/VMSA-2023-0012.html
Zyxel	CVE-2023-27992	Multiple NAS Devices	https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products
	CVE-2023-33009 CVE-2023-33010	Multiple Firewalls	https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls

Full CISA catalog can be referenced here:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog