PatchTheCVEdevexpress vulnerabilities
Recent CVEs affecting devexpress products. 4 tracked.
devexpress has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-04-28. Highest priority: CVE-2023-35817 (score 28/100).
- CVE-2023-35817 MEDIUM 5.0 UPGRADE DevExpress before 23.1.3 allows AsyncDownloader SSRF.
- CVE-2023-35816 LOW 3.5 UPGRADE DevExpress before 23.1.3 allows arbitrary TypeConverter conversion.
- CVE-2023-35815 LOW 3.5 UPGRADE DevExpress before 23.1.3 has a data-source protection mechanism bypass during deserialization on XML data.
- CVE-2023-35814 LOW 3.5 UPGRADE DevExpress before 23.1.3 does not properly protect XtraReport serialized data in ASP.NET web forms.
FAQ
How do I fix devexpress vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is devexpress being exploited right now?
None of the tracked devexpress CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which devexpress CVE should I patch first?
CVE-2023-35817 currently ranks highest (28/100): DevExpress before 23.1.3 allows AsyncDownloader SSRF..