Known Exploited Vulnerabilities
Page 6 of 18. 1731 CVEs confirmed as actively exploited, per the CISA KEV catalog.
Catalog Entries
1731 total| CVE | Vulnerability | CVSS | EPSS | Added | Due |
|---|---|---|---|---|---|
| CVE-2024-35250 | Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability | 7.8 | 25.2% | 2024-12-16 | 2025-01-06 |
| CVE-2024-20767 | Adobe ColdFusion Improper Access Control Vulnerability | 7.4 | 98.5% | 2024-12-16 | 2025-01-06 |
| CVE-2024-50623 | Cleo Multiple Products Unrestricted File Upload Vulnerability Ransomware | 9.8 | 98.6% | 2024-12-13 | 2025-01-03 |
| CVE-2024-49138 | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability | 7.8 | 26.2% | 2024-12-10 | 2024-12-31 |
| CVE-2024-51378 | CyberPanel Incorrect Default Permissions Vulnerability Ransomware | 10.0 | 94.7% | 2024-12-04 | 2024-12-25 |
| CVE-2024-11680 | ProjectSend Improper Authentication Vulnerability | 9.8 | 91.7% | 2024-12-03 | 2024-12-24 |
| CVE-2024-11667 | Zyxel Multiple Firewalls Path Traversal Vulnerability Ransomware | 7.5 | 2.9% | 2024-12-03 | 2024-12-24 |
| CVE-2023-45727 | North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability | 7.5 | 3.5% | 2024-12-03 | 2024-12-24 |
| CVE-2023-28461 | Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability Ransomware | 9.8 | 68.1% | 2024-11-25 | 2024-12-16 |
| CVE-2024-44309 | Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability | 6.3 | 22.6% | 2024-11-21 | 2024-12-12 |
| CVE-2024-44308 | Apple Multiple Products Code Execution Vulnerability | 8.8 | 10.1% | 2024-11-21 | 2024-12-12 |
| CVE-2024-21287 | Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability | 7.5 | 1.7% | 2024-11-21 | 2024-12-12 |
| CVE-2024-38813 | VMware vCenter Server Privilege Escalation Vulnerability | 7.5 | 17.4% | 2024-11-20 | 2024-12-11 |
| CVE-2024-38812 | VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | 9.8 | 54.6% | 2024-11-20 | 2024-12-11 |
| CVE-2024-9474 | Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability Ransomware | 6.9 | 94.7% | 2024-11-18 | 2024-12-09 |
| CVE-2024-1212 | Progress Kemp LoadMaster OS Command Injection Vulnerability | 10.0 | 95.4% | 2024-11-18 | 2024-12-09 |
| CVE-2024-0012 | Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability Ransomware | 9.3 | 99.8% | 2024-11-18 | 2024-12-09 |
| CVE-2024-9465 | Palo Alto Networks Expedition SQL Injection Vulnerability | 9.2 | 99.6% | 2024-11-14 | 2024-12-05 |
| CVE-2024-9463 | Palo Alto Networks Expedition OS Command Injection Vulnerability | 9.9 | 98.5% | 2024-11-14 | 2024-12-05 |
| CVE-2024-49039 | Microsoft Windows Task Scheduler Privilege Escalation Vulnerability Ransomware | 8.8 | 14.2% | 2024-11-12 | 2024-12-03 |
| CVE-2024-43451 | Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability | 6.5 | 84.1% | 2024-11-12 | 2024-12-03 |
| CVE-2021-41277 | Metabase GeoJSON API Local File Inclusion Vulnerability | 10.0 | 97.2% | 2024-11-12 | 2024-12-03 |
| CVE-2021-26086 | Atlassian Jira Server and Data Center Path Traversal Vulnerability | 5.3 | 100.0% | 2024-11-12 | 2024-12-03 |
| CVE-2014-2120 | Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability | 5.4 | 22.6% | 2024-11-12 | 2024-12-03 |
| CVE-2024-5910 | Palo Alto Networks Expedition Missing Authentication Vulnerability | 9.3 | 91.8% | 2024-11-07 | 2024-11-28 |
| CVE-2024-51567 | CyberPanel Incorrect Default Permissions Vulnerability Ransomware | 10.0 | 86.6% | 2024-11-07 | 2024-11-28 |
| CVE-2024-43093 | Android Framework Privilege Escalation Vulnerability | 7.3 | 0.7% | 2024-11-07 | 2024-11-28 |
| CVE-2019-16278 | Nostromo nhttpd Directory Traversal Vulnerability | 9.8 | 99.0% | 2024-11-07 | 2024-11-28 |
| CVE-2024-8957 | PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability | 7.2 | 79.7% | 2024-11-04 | 2024-11-25 |
| CVE-2024-8956 | PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability | 9.1 | 58.8% | 2024-11-04 | 2024-11-25 |
| CVE-2024-37383 | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | 6.1 | 73.3% | 2024-10-24 | 2024-11-14 |
| CVE-2024-20481 | Cisco ASA and FTD Denial-of-Service Vulnerability | 5.8 | 15.8% | 2024-10-24 | 2024-11-14 |
| CVE-2024-47575 | Fortinet FortiManager Missing Authentication Vulnerability | 9.8 | 94.8% | 2024-10-23 | 2024-11-13 |
| CVE-2024-38094 | Microsoft SharePoint Deserialization Vulnerability Ransomware | 7.2 | 50.9% | 2024-10-22 | 2024-11-12 |
| CVE-2024-9537 | ScienceLogic SL1 Unspecified Vulnerability | 9.8 | 3.8% | 2024-10-21 | 2024-11-11 |
| CVE-2024-40711 | Veeam Backup and Replication Deserialization Vulnerability Ransomware | 9.8 | 90.4% | 2024-10-17 | 2024-11-07 |
| CVE-2024-9680 | Mozilla Firefox Use-After-Free Vulnerability Ransomware | 9.8 | 23.2% | 2024-10-15 | 2024-11-05 |
| CVE-2024-30088 | Microsoft Windows Kernel TOCTOU Race Condition Vulnerability Ransomware | 7.0 | 68.2% | 2024-10-15 | 2024-11-05 |
| CVE-2024-28987 | SolarWinds Web Help Desk Hardcoded Credential Vulnerability | 9.1 | 93.3% | 2024-10-15 | 2024-11-05 |
| CVE-2024-9380 | Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability | 7.2 | 59.7% | 2024-10-09 | 2024-10-30 |
| CVE-2024-9379 | Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability | 6.5 | 43.8% | 2024-10-09 | 2024-10-30 |
| CVE-2024-23113 | Fortinet Multiple Products Format String Vulnerability | 9.8 | 61.7% | 2024-10-09 | 2024-10-30 |
| CVE-2024-43573 | Microsoft Windows MSHTML Platform Spoofing Vulnerability | 6.5 | 46.1% | 2024-10-08 | 2024-10-29 |
| CVE-2024-43572 | Microsoft Windows Management Console Remote Code Execution Vulnerability | 7.8 | 66.7% | 2024-10-08 | 2024-10-29 |
| CVE-2024-43047 | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 7.8 | 0.7% | 2024-10-08 | 2024-10-29 |
| CVE-2024-45519 | Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability | 10.0 | 99.9% | 2024-10-03 | 2024-10-24 |
| CVE-2024-29824 | Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability | 9.6 | 99.9% | 2024-10-02 | 2024-10-23 |
| CVE-2023-25280 | D-Link DIR-820 Router OS Command Injection Vulnerability | 9.8 | 97.9% | 2024-09-30 | 2024-10-21 |
| CVE-2020-15415 | DrayTek Multiple Vigor Routers OS Command Injection Vulnerability | 9.8 | 84.5% | 2024-09-30 | 2024-10-21 |
| CVE-2019-0344 | SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | 9.8 | 7.1% | 2024-09-30 | 2024-10-21 |
| CVE-2024-7593 | Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability | 9.8 | 100.0% | 2024-09-24 | 2024-10-15 |
| CVE-2024-8963 | Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability | 9.4 | 98.6% | 2024-09-19 | 2024-10-10 |
| CVE-2024-27348 | Apache HugeGraph-Server Improper Access Control Vulnerability | 9.8 | 99.2% | 2024-09-18 | 2024-10-09 |
| CVE-2022-21445 | Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | 9.8 | 62.5% | 2024-09-18 | 2024-10-09 |
| CVE-2020-14644 | Oracle WebLogic Server Remote Code Execution Vulnerability | 9.8 | 94.5% | 2024-09-18 | 2024-10-09 |
| CVE-2020-0618 | Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability Ransomware | 9.8 | 99.0% | 2024-09-18 | 2024-10-09 |
| CVE-2014-0502 | Adobe Flash Player Double Free Vulnerablity | 8.8 | 24.8% | 2024-09-17 | 2024-10-08 |
| CVE-2014-0497 | Adobe Flash Player Integer Underflow Vulnerablity | 8.8 | 99.9% | 2024-09-17 | 2024-10-08 |
| CVE-2013-0648 | Adobe Flash Player Code Execution Vulnerability | 8.8 | 11.1% | 2024-09-17 | 2024-10-08 |
| CVE-2013-0643 | Adobe Flash Player Incorrect Default Permissions Vulnerability | 8.8 | 10.5% | 2024-09-17 | 2024-10-08 |
| CVE-2024-6670 | Progress WhatsUp Gold SQL Injection Vulnerability Ransomware | 9.8 | 93.0% | 2024-09-16 | 2024-10-07 |
| CVE-2024-43461 | Microsoft Windows MSHTML Platform Spoofing Vulnerability | 8.8 | 54.5% | 2024-09-16 | 2024-10-07 |
| CVE-2024-8190 | Ivanti Cloud Services Appliance OS Command Injection Vulnerability | 7.2 | 88.5% | 2024-09-13 | 2024-10-04 |
| CVE-2024-38226 | Microsoft Publisher Protection Mechanism Failure Vulnerability | 7.3 | 2.7% | 2024-09-10 | 2024-10-01 |
| CVE-2024-38217 | Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability | 5.4 | 10.0% | 2024-09-10 | 2024-10-01 |
| CVE-2024-38014 | Microsoft Windows Installer Improper Privilege Management Vulnerability | 7.8 | 6.3% | 2024-09-10 | 2024-10-01 |
| CVE-2024-40766 | SonicWall SonicOS Improper Access Control Vulnerability Ransomware | 9.3 | 18.4% | 2024-09-09 | 2024-09-30 |
| CVE-2017-1000253 | Linux Kernel PIE Stack Buffer Corruption Vulnerability Ransomware | 7.8 | 10.7% | 2024-09-09 | 2024-09-30 |
| CVE-2016-3714 | ImageMagick Improper Input Validation Vulnerability | 8.4 | 97.5% | 2024-09-09 | 2024-09-30 |
| CVE-2024-7262 | Kingsoft WPS Office Path Traversal Vulnerability | 9.3 | 2.9% | 2024-09-03 | 2024-09-24 |
| CVE-2021-20124 | Draytek VigorConnect Path Traversal Vulnerability | 7.5 | 96.3% | 2024-09-03 | 2024-09-24 |
| CVE-2021-20123 | Draytek VigorConnect Path Traversal Vulnerability | 7.5 | 90.2% | 2024-09-03 | 2024-09-24 |
| CVE-2024-7965 | Google Chromium V8 Inappropriate Implementation Vulnerability | 8.8 | 18.5% | 2024-08-28 | 2024-09-18 |
| CVE-2024-38856 | Apache OFBiz Incorrect Authorization Vulnerability | 8.1 | 99.4% | 2024-08-27 | 2024-09-17 |
| CVE-2024-7971 | Google Chromium V8 Type Confusion Vulnerability | 8.8 | 21.1% | 2024-08-26 | 2024-09-16 |
| CVE-2024-39717 | Versa Director Dangerous File Type Upload Vulnerability | 6.6 | 4.0% | 2024-08-23 | 2024-09-13 |
| CVE-2022-0185 | Linux Kernel Heap-Based Buffer Overflow Vulnerability | 8.4 | 25.2% | 2024-08-21 | 2024-09-11 |
| CVE-2021-33045 | Dahua IP Camera Authentication Bypass Vulnerability | 9.8 | 99.6% | 2024-08-21 | 2024-09-11 |
| CVE-2021-33044 | Dahua IP Camera Authentication Bypass Vulnerability | 9.8 | 100.0% | 2024-08-21 | 2024-09-11 |
| CVE-2021-31196 | Microsoft Exchange Server Information Disclosure Vulnerability | 7.2 | 54.1% | 2024-08-21 | 2024-09-11 |
| CVE-2024-23897 | Jenkins Command Line Interface (CLI) Path Traversal Vulnerability Ransomware | 9.8 | 100.0% | 2024-08-19 | 2024-09-09 |
| CVE-2024-28986 | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | 9.8 | 84.6% | 2024-08-15 | 2024-09-05 |
| CVE-2024-38213 | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | 6.5 | 13.6% | 2024-08-13 | 2024-09-03 |
| CVE-2024-38193 | Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability | 7.8 | 28.5% | 2024-08-13 | 2024-09-03 |
| CVE-2024-38189 | Microsoft Project Remote Code Execution Vulnerability | 8.8 | 8.2% | 2024-08-13 | 2024-09-03 |
| CVE-2024-38178 | Microsoft Windows Scripting Engine Memory Corruption Vulnerability | 7.5 | 41.4% | 2024-08-13 | 2024-09-03 |
| CVE-2024-38107 | Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability | 7.8 | 1.6% | 2024-08-13 | 2024-09-03 |
| CVE-2024-38106 | Microsoft Windows Kernel Privilege Escalation Vulnerability | 7.0 | 6.3% | 2024-08-13 | 2024-09-03 |
| CVE-2024-36971 | Android Kernel Remote Code Execution Vulnerability | 7.8 | 2.7% | 2024-08-07 | 2024-08-28 |
| CVE-2024-32113 | Apache OFBiz Path Traversal Vulnerability | 9.1 | 99.9% | 2024-08-07 | 2024-08-28 |
| CVE-2018-0824 | Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability | 7.5 | 73.2% | 2024-08-05 | 2024-08-26 |
| CVE-2024-37085 | VMware ESXi Authentication Bypass Vulnerability Ransomware | 6.8 | 26.8% | 2024-07-30 | 2024-08-20 |
| CVE-2024-5217 | ServiceNow Incomplete List of Disallowed Inputs Vulnerability | 9.8 | 99.6% | 2024-07-29 | 2024-08-19 |
| CVE-2024-4879 | ServiceNow Improper Input Validation Vulnerability | 9.8 | 100.0% | 2024-07-29 | 2024-08-19 |
| CVE-2023-45249 | Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability | 9.8 | 53.3% | 2024-07-29 | 2024-08-19 |
| CVE-2024-39891 | Twilio Authy Information Disclosure Vulnerability | 5.3 | 1.7% | 2024-07-23 | 2024-08-13 |
| CVE-2012-4792 | Microsoft Internet Explorer Use-After-Free Vulnerability | 8.8 | 78.8% | 2024-07-23 | 2024-08-13 |
| CVE-2024-34102 | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | 9.8 | 100.0% | 2024-07-17 | 2024-08-07 |
| CVE-2024-28995 | SolarWinds Serv-U Path Traversal Vulnerability | 8.6 | 99.6% | 2024-07-17 | 2024-08-07 |
| CVE-2022-22948 | VMware vCenter Server Incorrect Default File Permissions Vulnerability | 6.5 | 13.3% | 2024-07-17 | 2024-08-07 |