cve recordexploit reported

CVE-2023-38646

CVSS—

Severitynone

Weakness—

EPSS98.7%99.9th percentile

Exploited1 KEV source

patch window

Called exploited 115 days after disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE publishedJul 21, 2023
First KEV listingNov 13, 20234mo
Last sightingSep 4, 20262.8y

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Nov 13, 2023
CIRCLaggregator, mirrors the abovelisted Oct 13, 2023, not counted

Sources1 of 3

Listings differ by—

Strongest claimconfirmed

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

reported exploitationSep 4, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationSep 3, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationSep 2, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationSep 1, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationAug 31, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationAug 30, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability

1035 public reports collected from VulnCheck and CIRCL, first on Nov 13, 2023. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2023-38646

CVE-2023-38646Aug 8, 2026critical

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase has issued a critical alert regarding a zero-day vulnerability in its business intelligence software that is actively being exploited in the wild. The flaw reportedly allows unauthenticated attackers to achieve administrator access, facilitating credential theft and data exfiltration. Metabase Cloud instances have been patched, and self-hosted users are urged to update their…