An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.
CVE-2023-51704 is a cross-site scripting (XSS) vulnerability in MediaWiki affecting certain versions prior to 1.35.14, between 1.36.0 and before 1.39.6, and between 1.40.0 and before 1.40.2. The issue arises in the RightsLogFormatter.php component, where group-*-member messages can lead to XSS on the Special:log/rights page. Fixed versions are 1.35.14, 1.39.6, and 1.40.2.
CVE-2023-45362 is an information leak vulnerability in MediaWiki's DifferenceEngine.php component. It affects versions prior to 1.35.12, versions from 1.36.0 up to but excluding 1.39.5, and versions from 1.40.0 up to but excluding 1.40.1. The flaw causes intermediate revisions by the same user to ignore username suppression, potentially exposing user information that should be hidden.
An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is XSS in youhavenewmessagesmanyusers and youhavenewmessages i18n messages. This is related to MediaWiki:Youhavenewmessagesfromusers.
CVE-2023-33010 is a critical buffer overflow vulnerability in multiple Zyxel firewall and VPN device firmware versions, including ATP, USG FLEX, USG20(W)-VPN, and ZyWALL/USG series. The flaw exists in the ID processing function and allows an unauthenticated attacker to remotely execute code or cause denial-of-service conditions. It affects firmware versions ranging approximately from 4.25 to 5.36 Patch 1, depending on the product line. The vulnerability has a CVSS score of 9.8, indicating high exploitability without authentication or user interaction. Although no known exploits are currently reported in the wild, the potential impact on confidentiality, integrity, and availability is severe. European organizations using Zyxel network security appliances are at risk, especially those in critical infrastructure, government, and enterprises relying on these devices for perimeter defense. Mitigation requires immediate firmware updates once patches are available, network segmentation, and monitoring for anomalous traffic targeting these devices.
CVE-2023-33009 is a critical buffer overflow vulnerability in multiple Zyxel firewall and VPN device firmware versions (4.60 through 5.36 Patch 1). It affects Zyxel ATP, USG FLEX, USG20(W)-VPN, VPN series, and ZyWALL/USG series devices. The flaw exists in the notification function and can be exploited remotely without authentication or user interaction. Successful exploitation can lead to denial-of-service or remote code execution, compromising confidentiality, integrity, and availability. No known exploits are currently reported in the wild, but the high CVSS score (9.8) indicates severe risk. European organizations using these Zyxel devices should prioritize patching and implement network-level protections. Countries with significant Zyxel deployments and critical infrastructure reliance on these devices are at higher risk.