CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2024-38189 KEV |
[KEV] Vulnerability in Microsoft Project (CVE-2024-38189)
Vulnerability in Microsoft Project (CVE-2024-38189). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38178 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-38178)
Vulnerability in Microsoft Windows (CVE-2024-38178). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38213 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-38213)
Vulnerability in Microsoft Windows (CVE-2024-38213). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38193 KEV |
[KEV] Use-After-Free in Microsoft Windows (CVE-2024-38193)
Vulnerability in Microsoft Windows (CVE-2024-38193). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38106 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-38106)
Vulnerability in Microsoft Windows (CVE-2024-38106). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38107 KEV |
[KEV] Use-After-Free in Microsoft Windows (CVE-2024-38107)
Vulnerability in Microsoft Windows (CVE-2024-38107). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-36971 KEV |
[KEV] Use-After-Free in Android Kernel (CVE-2024-36971)
Vulnerability in Android Kernel (CVE-2024-36971). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-32113 KEV |
[KEV] Path Traversal in Apache OFBiz (CVE-2024-32113)
Path traversal in Apache OFBiz (CVE-2024-32113). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-0824 KEV |
[KEV] Unsafe Deserialization in Microsoft Windows (CVE-2018-0824)
Vulnerability in Microsoft Windows (CVE-2018-0824). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-37085 KEV |
[KEV] Vulnerability in VMware ESXi (CVE-2024-37085)
Vulnerability in VMware ESXi (CVE-2024-37085). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-4879 KEV |
[KEV] Vulnerability in ServiceNow Utah, Vancouver, and Washington DC Now Platform (CVE-2024-4879)
Vulnerability in ServiceNow Utah, Vancouver, and Washington DC Now Platform (CVE-2024-4879). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-5217 KEV |
[KEV] Vulnerability in ServiceNow Utah, Vancouver, and Washington DC Now Platform (CVE-2024-5217)
Vulnerability in ServiceNow Utah, Vancouver, and Washington DC Now Platform (CVE-2024-5217). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-45249 KEV |
[KEV] Vulnerability in Acronis Cyber Infrastructure (ACI) (CVE-2023-45249)
Vulnerability in Acronis Cyber Infrastructure (ACI) (CVE-2023-45249). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2012-4792 KEV |
[KEV] Use-After-Free in Microsoft Internet Explorer (CVE-2012-4792)
Vulnerability in Microsoft Internet Explorer (CVE-2012-4792). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-39891 KEV |
[KEV] Vulnerability in Twilio Authy (CVE-2024-39891)
Vulnerability in Twilio Authy (CVE-2024-39891). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-34102 KEV |
[KEV] XXE (XML External Entity) in Adobe Commerce and Magento Open Source (CVE-2024-34102)
Vulnerability in Adobe Commerce and Magento Open Source (CVE-2024-34102). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-28995 KEV |
[KEV] Path Traversal in SolarWinds Serv-U (CVE-2024-28995)
Path traversal in SolarWinds Serv-U (CVE-2024-28995). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-22948 KEV |
[KEV] Vulnerability in VMware vCenter Server (CVE-2022-22948)
Vulnerability in VMware vCenter Server (CVE-2022-22948). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-36401 KEV |
[KEV] Vulnerability in OSGeo GeoServer (CVE-2024-36401)
Vulnerability in OSGeo GeoServer (CVE-2024-36401). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38112 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-38112)
Vulnerability in Microsoft Windows (CVE-2024-38112). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-38080 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-38080)
Vulnerability in Microsoft Windows (CVE-2024-38080). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-23692 KEV |
[KEV] Vulnerability in Rejetto HTTP File Server (CVE-2024-23692)
Vulnerability in Rejetto HTTP File Server (CVE-2024-23692). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-20399 KEV |
[KEV] OS Command Injection in Cisco NX-OS (CVE-2024-20399)
OS command injection in Cisco NX-OS (CVE-2024-20399). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-24816 KEV |
[KEV] Code Injection in OSGeo JAI-EXT (CVE-2022-24816)
Code injection in OSGeo JAI-EXT (CVE-2022-24816). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-2586 KEV |
[KEV] Use-After-Free in Linux Kernel (CVE-2022-2586)
Vulnerability in Linux Kernel (CVE-2022-2586). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-13965 KEV |
[KEV] Vulnerability in Roundcube Webmail (CVE-2020-13965)
Vulnerability in Roundcube Webmail (CVE-2020-13965). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-32896 KEV |
[KEV] Vulnerability in Android Pixel (CVE-2024-32896)
Vulnerability in Android Pixel (CVE-2024-32896). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-26169 KEV |
[KEV] Privilege Escalation in Microsoft Windows (CVE-2024-26169)
Vulnerability in Microsoft Windows (CVE-2024-26169). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-4358 KEV |
[KEV] Vulnerability in Progress Telerik Report Server (CVE-2024-4358)
Vulnerability in Progress Telerik Report Server (CVE-2024-4358). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-4610 KEV |
[KEV] Use-After-Free in Arm Mali GPU Kernel Driver (CVE-2024-4610)
Vulnerability in Arm Mali GPU Kernel Driver (CVE-2024-4610). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to SoCVersion:2024-07-05 or later.
|
|
| CVE-2024-4577 KEV |
[KEV] OS Command Injection in PHP Group PHP (CVE-2024-4577)
OS command injection in PHP Group PHP (CVE-2024-4577). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2017-3506 KEV |
[KEV] OS Command Injection in Oracle WebLogic Server (CVE-2017-3506)
OS command injection in Oracle WebLogic Server (CVE-2017-3506). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-24919 KEV |
[KEV] Information Disclosure in Check Point Quantum Security Gateways (CVE-2024-24919)
Vulnerability in Check Point Quantum Security Gateways (CVE-2024-24919). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-1086 KEV |
[KEV] Use-After-Free in Linux Kernel (CVE-2024-1086)
Vulnerability in Linux Kernel (CVE-2024-1086). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-4978 KEV |
[KEV] Vulnerability in Justice AV Solutions Viewer (CVE-2024-4978)
Vulnerability in Justice AV Solutions Viewer (CVE-2024-4978). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-5274 KEV |
[KEV] Vulnerability in Google Chromium V8 (CVE-2024-5274)
Vulnerability in Google Chromium V8 (CVE-2024-5274). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-17519 KEV |
[KEV] Vulnerability in Apache Flink (CVE-2020-17519)
Vulnerability in Apache Flink (CVE-2020-17519). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-43208 KEV |
[KEV] Unsafe Deserialization in NextGen Healthcare Mirth Connect (CVE-2023-43208)
Vulnerability in NextGen Healthcare Mirth Connect (CVE-2023-43208). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-4947 KEV |
[KEV] Vulnerability in Google Chromium V8 (CVE-2024-4947)
Vulnerability in Google Chromium V8 (CVE-2024-4947). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2014-100005 KEV |
[KEV] Cross-Site Request Forgery (CSRF) in D-Link DIR-600 Router (CVE-2014-100005)
Vulnerability in D-Link DIR-600 Router (CVE-2014-100005). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-40655 KEV |
[KEV] Authorization Flaw in D-Link DIR-605 Router (CVE-2021-40655)
Vulnerability in D-Link DIR-605 Router (CVE-2021-40655). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-4761 KEV |
[KEV] Out-of-Bounds Write in Google Chromium V8 (CVE-2024-4761)
Out-of-bounds write in Google Chromium V8 (CVE-2024-4761). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-30051 KEV |
[KEV] Vulnerability in Microsoft DWM Core Library (CVE-2024-30051)
Vulnerability in Microsoft DWM Core Library (CVE-2024-30051). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-30040 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-30040)
Vulnerability in Microsoft Windows (CVE-2024-30040). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-4671 KEV |
[KEV] Use-After-Free in Google Chromium (CVE-2024-4671)
Vulnerability in Google Chromium (CVE-2024-4671). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-7028 KEV |
[KEV] Vulnerability in GitLab CE/EE (CVE-2023-7028)
Vulnerability in GitLab CE/EE (CVE-2023-7028). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-29988 KEV |
[KEV] Vulnerability in Microsoft SmartScreen Prompt (CVE-2024-29988)
Vulnerability in Microsoft SmartScreen Prompt (CVE-2024-29988). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-20353 KEV |
[KEV] Vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (CVE-2024-20353)
Vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (CVE-2024-20353). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-20359 KEV |
[KEV] Code Injection in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (CVE-2024-20359)
Code injection in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (CVE-2024-20359). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-4040 KEV |
[KEV] Vulnerability in CrushFTP (CVE-2024-4040)
Vulnerability in CrushFTP (CVE-2024-4040). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
