CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2024-55591 KEV |
[KEV] Vulnerability in Fortinet FortiOS and FortiProxy (CVE-2024-55591)
Vulnerability in Fortinet FortiOS and FortiProxy (CVE-2024-55591). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-21333 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2025-21333)
Vulnerability in Microsoft Windows (CVE-2025-21333). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-21334 KEV |
[KEV] Use-After-Free in Microsoft Windows (CVE-2025-21334)
Vulnerability in Microsoft Windows (CVE-2025-21334). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-21335 KEV |
[KEV] Use-After-Free in Microsoft Windows (CVE-2025-21335)
Vulnerability in Microsoft Windows (CVE-2025-21335). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-12686 KEV |
[KEV] OS Command Injection in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) (CVE-2024-12686)
OS command injection in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) (CVE-2024-12686). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-48365 KEV |
[KEV] Vulnerability in Qlik Sense (CVE-2023-48365)
Vulnerability in Qlik Sense (CVE-2023-48365). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2025-0282 KEV |
[KEV] Vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA Gateways (CVE-2025-0282)
Vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA Gateways (CVE-2025-0282). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-41713 KEV |
[KEV] Path Traversal in Mitel MiCollab (CVE-2024-41713)
Path traversal in Mitel MiCollab (CVE-2024-41713). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-55550 KEV |
[KEV] Path Traversal in Mitel MiCollab (CVE-2024-55550)
Path traversal in Mitel MiCollab (CVE-2024-55550). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-2883 KEV |
[KEV] Vulnerability in Oracle WebLogic Server (CVE-2020-2883)
Vulnerability in Oracle WebLogic Server (CVE-2020-2883). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-3393 KEV |
[KEV] Vulnerability in Palo Alto Networks PAN-OS (CVE-2024-3393)
Vulnerability in Palo Alto Networks PAN-OS (CVE-2024-3393). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-44207 KEV |
[KEV] Vulnerability in Acclaim Systems USAHERDS (CVE-2021-44207)
Vulnerability in Acclaim Systems USAHERDS (CVE-2021-44207). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-12356 KEV |
[KEV] Command Injection in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) (CVE-2024-12356)
Command injection in BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) (CVE-2024-12356). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-14933 KEV |
[KEV] OS Command Injection in NUUO NVRmini Devices (CVE-2018-14933)
OS command injection in NUUO NVRmini Devices (CVE-2018-14933). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-23227 KEV |
[KEV] Vulnerability in NUUO NVRmini2 Devices (CVE-2022-23227)
Vulnerability in NUUO NVRmini2 Devices (CVE-2022-23227). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-11001 KEV |
[KEV] OS Command Injection in Reolink Multiple IP Cameras (CVE-2019-11001)
OS command injection in Reolink Multiple IP Cameras (CVE-2019-11001). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-40407 KEV |
[KEV] OS Command Injection in Reolink RLC-410W IP Camera (CVE-2021-40407)
OS command injection in Reolink RLC-410W IP Camera (CVE-2021-40407). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-55956 KEV |
[KEV] Vulnerability in Cleo Multiple Products (CVE-2024-55956)
Vulnerability in Cleo Multiple Products (CVE-2024-55956). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-20767 KEV |
[KEV] Vulnerability in Adobe ColdFusion (CVE-2024-20767)
Vulnerability in Adobe ColdFusion (CVE-2024-20767). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-35250 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-35250)
Vulnerability in Microsoft Windows (CVE-2024-35250). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-50623 KEV |
[KEV] Unrestricted File Upload in Cleo Multiple Products (CVE-2024-50623)
Vulnerability in Cleo Multiple Products (CVE-2024-50623). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-49138 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-49138)
Vulnerability in Microsoft Windows (CVE-2024-49138). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-51378 KEV |
[KEV] Vulnerability in CyberPersons CyberPanel (CVE-2024-51378)
Vulnerability in CyberPersons CyberPanel (CVE-2024-51378). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-45727 KEV |
[KEV] XXE (XML External Entity) in North Grid Proself (CVE-2023-45727)
Vulnerability in North Grid Proself (CVE-2023-45727). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-11680 KEV |
[KEV] Authentication Bypass in ProjectSend (CVE-2024-11680)
Authentication bypass in ProjectSend (CVE-2024-11680). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-11667 KEV |
[KEV] Path Traversal in Zyxel Multiple Firewalls (CVE-2024-11667)
Path traversal in Zyxel Multiple Firewalls (CVE-2024-11667). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-28461 KEV |
[KEV] Vulnerability in Array Networks AG/vxAG ArrayOS (CVE-2023-28461)
Vulnerability in Array Networks AG/vxAG ArrayOS (CVE-2023-28461). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-44308 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2024-44308)
Vulnerability in Apple Multiple Products (CVE-2024-44308). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-44309 KEV |
[KEV] Cross-Site Scripting (XSS) in Apple Multiple Products (CVE-2024-44309)
Cross-site scripting in Apple Multiple Products (CVE-2024-44309). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-21287 KEV |
[KEV] Authorization Flaw in Oracle Agile Product Lifecycle Management (PLM) (CVE-2024-21287)
Vulnerability in Oracle Agile Product Lifecycle Management (PLM) (CVE-2024-21287). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38812 KEV |
[KEV] Vulnerability in VMware vCenter Server (CVE-2024-38812)
Vulnerability in VMware vCenter Server (CVE-2024-38812). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38813 KEV |
[KEV] Vulnerability in VMware vCenter Server (CVE-2024-38813)
Vulnerability in VMware vCenter Server (CVE-2024-38813). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-1212 KEV |
[KEV] OS Command Injection in Progress Kemp LoadMaster (CVE-2024-1212)
OS command injection in Progress Kemp LoadMaster (CVE-2024-1212). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-0012 KEV |
[KEV] Vulnerability in Palo Alto Networks PAN-OS (CVE-2024-0012)
Vulnerability in Palo Alto Networks PAN-OS (CVE-2024-0012). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-9474 KEV |
[KEV] Command Injection in Palo Alto Networks PAN-OS (CVE-2024-9474)
Command injection in Palo Alto Networks PAN-OS (CVE-2024-9474). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-9463 KEV |
[KEV] OS Command Injection in Palo Alto Networks Expedition (CVE-2024-9463)
OS command injection in Palo Alto Networks Expedition (CVE-2024-9463). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-9465 KEV |
[KEV] SQL Injection in Palo Alto Networks Expedition (CVE-2024-9465)
SQL injection in Palo Alto Networks Expedition (CVE-2024-9465). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-49039 KEV |
[KEV] Authentication Bypass in Microsoft Windows (CVE-2024-49039)
Authentication bypass in Microsoft Windows (CVE-2024-49039). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-43451 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-43451)
Vulnerability in Microsoft Windows (CVE-2024-43451). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-41277 KEV |
[KEV] Information Disclosure in Metabase (CVE-2021-41277)
Vulnerability in Metabase (CVE-2021-41277). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-2120 KEV |
[KEV] Cross-Site Scripting (XSS) in Cisco Adaptive Security Appliance (ASA) (CVE-2014-2120)
Cross-site scripting in Cisco Adaptive Security Appliance (ASA) (CVE-2014-2120). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-26086 KEV |
[KEV] Path Traversal in Atlassian Jira Server and Data Center (CVE-2021-26086)
Path traversal in Atlassian Jira Server and Data Center (CVE-2021-26086). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-5910 KEV |
[KEV] Vulnerability in Palo Alto Networks Expedition (CVE-2024-5910)
Vulnerability in Palo Alto Networks Expedition (CVE-2024-5910). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-43093 KEV |
[KEV] Vulnerability in Android Framework (CVE-2024-43093)
Vulnerability in Android Framework (CVE-2024-43093). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-51567 KEV |
[KEV] Vulnerability in Cyberpersons Cyberpanel (CVE-2024-51567)
Vulnerability in Cyberpersons Cyberpanel (CVE-2024-51567). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-16278 KEV |
[KEV] Path Traversal in Nostromo nhttpd (CVE-2019-16278)
Path traversal in Nostromo nhttpd (CVE-2019-16278). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-8957 KEV |
[KEV] OS Command Injection in PTZOptics PT30X-SDI/NDI Cameras (CVE-2024-8957)
OS command injection in PTZOptics PT30X-SDI/NDI Cameras (CVE-2024-8957). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-8956 KEV |
[KEV] Authentication Bypass in PTZOptics PT30X-SDI/NDI Cameras (CVE-2024-8956)
Authentication bypass in PTZOptics PT30X-SDI/NDI Cameras (CVE-2024-8956). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-20481 KEV |
[KEV] Vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (CVE-2024-20481)
Vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (CVE-2024-20481). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-37383 KEV |
[KEV] Cross-Site Scripting (XSS) in Roundcube Webmail (CVE-2024-37383)
Cross-site scripting in Roundcube Webmail (CVE-2024-37383). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
