CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2024-47575 KEV |
[KEV] Vulnerability in Fortinet FortiManager (CVE-2024-47575)
Vulnerability in Fortinet FortiManager (CVE-2024-47575). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38094 KEV |
[KEV] Unsafe Deserialization in Microsoft SharePoint (CVE-2024-38094)
Vulnerability in Microsoft SharePoint (CVE-2024-38094). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-9537 KEV |
[KEV] Vulnerability in ScienceLogic SL1 (CVE-2024-9537)
Vulnerability in ScienceLogic SL1 (CVE-2024-9537). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-40711 KEV |
[KEV] Unsafe Deserialization in Veeam Backup & Replication (CVE-2024-40711)
Vulnerability in Veeam Backup & Replication (CVE-2024-40711). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-30088 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-30088)
Vulnerability in Microsoft Windows (CVE-2024-30088). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-9680 KEV |
[KEV] Use-After-Free in Mozilla Firefox (CVE-2024-9680)
Vulnerability in Mozilla Firefox (CVE-2024-9680). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-28987 KEV |
[KEV] Vulnerability in SolarWinds Web Help Desk (CVE-2024-28987)
Vulnerability in SolarWinds Web Help Desk (CVE-2024-28987). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-23113 KEV |
[KEV] Vulnerability in Fortinet Multiple Products (CVE-2024-23113)
Vulnerability in Fortinet Multiple Products (CVE-2024-23113). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-9379 KEV |
[KEV] SQL Injection in Ivanti Cloud Services Appliance (CSA) (CVE-2024-9379)
SQL injection in Ivanti Cloud Services Appliance (CSA) (CVE-2024-9379). Data can be tampered with by attackers. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-9380 KEV |
[KEV] Command Injection in Ivanti Cloud Services Appliance (CSA) (CVE-2024-9380)
Command injection in Ivanti Cloud Services Appliance (CSA) (CVE-2024-9380). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-43047 KEV |
[KEV] Use-After-Free in Qualcomm Multiple Chipsets (CVE-2024-43047)
Vulnerability in Qualcomm Multiple Chipsets (CVE-2024-43047). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-43572 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-43572)
Vulnerability in Microsoft Windows (CVE-2024-43572). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-43573 KEV |
[KEV] Cross-Site Scripting (XSS) in Microsoft Windows (CVE-2024-43573)
Cross-site scripting in Microsoft Windows (CVE-2024-43573). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-45519 KEV |
[KEV] Vulnerability in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2024-45519)
Vulnerability in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2024-45519). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-29824 KEV |
[KEV] SQL Injection in Ivanti Endpoint Manager (EPM) (CVE-2024-29824)
SQL injection in Ivanti Endpoint Manager (EPM) (CVE-2024-29824). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-25280 KEV |
[KEV] OS Command Injection in D-Link DIR-820 Router (CVE-2023-25280)
OS command injection in D-Link DIR-820 Router (CVE-2023-25280). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-15415 KEV |
[KEV] OS Command Injection in DrayTek Multiple Vigor Routers (CVE-2020-15415)
OS command injection in DrayTek Multiple Vigor Routers (CVE-2020-15415). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-0344 KEV |
[KEV] Unsafe Deserialization in SAP Commerce Cloud (CVE-2019-0344)
Vulnerability in SAP Commerce Cloud (CVE-2019-0344). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-7593 KEV |
[KEV] Authentication Bypass in Ivanti Virtual Traffic Manager (CVE-2024-7593)
Authentication bypass in Ivanti Virtual Traffic Manager (CVE-2024-7593). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-8963 KEV |
[KEV] Path Traversal in Ivanti Cloud Services Appliance (CSA) (CVE-2024-8963)
Path traversal in Ivanti Cloud Services Appliance (CSA) (CVE-2024-8963). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-27348 KEV |
[KEV] Vulnerability in Apache HugeGraph-Server (CVE-2024-27348)
Vulnerability in Apache HugeGraph-Server (CVE-2024-27348). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-0618 KEV |
[KEV] Unsafe Deserialization in Microsoft SQL Server (CVE-2020-0618)
Vulnerability in Microsoft SQL Server (CVE-2020-0618). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-21445 KEV |
[KEV] Unsafe Deserialization in Oracle ADF Faces (CVE-2022-21445)
Vulnerability in Oracle ADF Faces (CVE-2022-21445). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-14644 KEV |
[KEV] Vulnerability in Oracle WebLogic Server (CVE-2020-14644)
Vulnerability in Oracle WebLogic Server (CVE-2020-14644). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-0497 KEV |
[KEV] Vulnerability in Adobe Flash Player (CVE-2014-0497)
Vulnerability in Adobe Flash Player (CVE-2014-0497). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2013-0643 KEV |
[KEV] Vulnerability in Adobe Flash Player (CVE-2013-0643)
Vulnerability in Adobe Flash Player (CVE-2013-0643). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2013-0648 KEV |
[KEV] Vulnerability in Adobe Flash Player (CVE-2013-0648)
Vulnerability in Adobe Flash Player (CVE-2013-0648). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-0502 KEV |
[KEV] Vulnerability in Adobe Flash Player (CVE-2014-0502)
Vulnerability in Adobe Flash Player (CVE-2014-0502). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-43461 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-43461)
Vulnerability in Microsoft Windows (CVE-2024-43461). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-6670 KEV |
[KEV] SQL Injection in Progress WhatsUp Gold (CVE-2024-6670)
SQL injection in Progress WhatsUp Gold (CVE-2024-6670). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-8190 KEV |
[KEV] OS Command Injection in Ivanti Cloud Services Appliance (CVE-2024-8190)
OS command injection in Ivanti Cloud Services Appliance (CVE-2024-8190). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38226 KEV |
[KEV] Vulnerability in Microsoft Publisher (CVE-2024-38226)
Vulnerability in Microsoft Publisher (CVE-2024-38226). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38014 KEV |
[KEV] Privilege Escalation in Microsoft Windows (CVE-2024-38014)
Vulnerability in Microsoft Windows (CVE-2024-38014). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38217 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-38217)
Vulnerability in Microsoft Windows (CVE-2024-38217). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-3714 KEV |
[KEV] Vulnerability in Imagemagick (CVE-2016-3714)
Vulnerability in Imagemagick (CVE-2016-3714). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-1000253 KEV |
[KEV] Buffer Overflow in Linux Kernel (CVE-2017-1000253)
Vulnerability in Linux Kernel (CVE-2017-1000253). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-40766 KEV |
[KEV] Vulnerability in SonicWall SonicOS (CVE-2024-40766)
Vulnerability in SonicWall SonicOS (CVE-2024-40766). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-20123 KEV |
[KEV] Path Traversal in DrayTek VigorConnect (CVE-2021-20123)
Path traversal in DrayTek VigorConnect (CVE-2021-20123). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-20124 KEV |
[KEV] Path Traversal in DrayTek VigorConnect (CVE-2021-20124)
Path traversal in DrayTek VigorConnect (CVE-2021-20124). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-7262 KEV |
[KEV] Path Traversal in Kingsoft WPS Office (CVE-2024-7262)
Path traversal in Kingsoft WPS Office (CVE-2024-7262). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-7965 KEV |
[KEV] Vulnerability in Google Chromium V8 (CVE-2024-7965)
Vulnerability in Google Chromium V8 (CVE-2024-7965). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38856 KEV |
[KEV] Authorization Flaw in Apache OFBiz (CVE-2024-38856)
Vulnerability in Apache OFBiz (CVE-2024-38856). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-7971 KEV |
[KEV] Vulnerability in Google Chromium V8 (CVE-2024-7971)
Vulnerability in Google Chromium V8 (CVE-2024-7971). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-39717 KEV |
[KEV] Unrestricted File Upload in Versa Director (CVE-2024-39717)
Vulnerability in Versa Director (CVE-2024-39717). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-33044 KEV |
[KEV] Authentication Bypass in Dahua IP Camera Firmware (CVE-2021-33044)
Authentication bypass in Dahua IP Camera Firmware (CVE-2021-33044). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-33045 KEV |
[KEV] Authentication Bypass in Dahua IP Camera Firmware (CVE-2021-33045)
Authentication bypass in Dahua IP Camera Firmware (CVE-2021-33045). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-0185 KEV |
[KEV] Vulnerability in Linux Kernel (CVE-2022-0185)
Vulnerability in Linux Kernel (CVE-2022-0185). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-31196 KEV |
[KEV] Vulnerability in Microsoft Exchange Server (CVE-2021-31196)
Vulnerability in Microsoft Exchange Server (CVE-2021-31196). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-23897 KEV |
[KEV] Path Traversal in org.jenkins-ci.main:jenkins-core (CVE-2024-23897)
Path traversal in org.jenkins-ci.main:jenkins-core (CVE-2024-23897). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 2.442 or later.
|
|
| CVE-2024-28986 KEV |
[KEV] Unsafe Deserialization in SolarWinds Web Help Desk (CVE-2024-28986)
Vulnerability in SolarWinds Web Help Desk (CVE-2024-28986). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
