CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2022-38028 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2022-38028)
Vulnerability in Microsoft Windows (CVE-2022-38028). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-3400 KEV |
[KEV] Vulnerability in Palo Alto Networks PAN-OS (CVE-2024-3400)
Vulnerability in Palo Alto Networks PAN-OS (CVE-2024-3400). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-3272 KEV |
[KEV] Vulnerability in D-Link Multiple NAS Devices (CVE-2024-3272)
Vulnerability in D-Link Multiple NAS Devices (CVE-2024-3272). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-3273 KEV |
[KEV] Command Injection in D-Link Multiple NAS Devices (CVE-2024-3273)
Command injection in D-Link Multiple NAS Devices (CVE-2024-3273). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-29745 KEV |
[KEV] Vulnerability in Android Pixel (CVE-2024-29745)
Vulnerability in Android Pixel (CVE-2024-29745). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-29748 KEV |
[KEV] Vulnerability in Android Pixel (CVE-2024-29748)
Vulnerability in Android Pixel (CVE-2024-29748). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-24955 KEV |
[KEV] Code Injection in Microsoft SharePoint Server (CVE-2023-24955)
Code injection in Microsoft SharePoint Server (CVE-2023-24955). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-48788 KEV |
[KEV] SQL Injection in Fortinet FortiClient EMS (CVE-2023-48788)
SQL injection in Fortinet FortiClient EMS (CVE-2023-48788). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-44529 KEV |
[KEV] Code Injection in Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) (CVE-2021-44529)
Code injection in Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) (CVE-2021-44529). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-7256 KEV |
[KEV] OS Command Injection in Nice Linear eMerge E3-Series (CVE-2019-7256)
OS command injection in Nice Linear eMerge E3-Series (CVE-2019-7256). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-27198 KEV |
[KEV] Vulnerability in JetBrains TeamCity (CVE-2024-27198)
Vulnerability in JetBrains TeamCity (CVE-2024-27198). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-23296 KEV |
[KEV] Out-of-Bounds Write in Apple Multiple Products (CVE-2024-23296)
Out-of-bounds write in Apple Multiple Products (CVE-2024-23296). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-23225 KEV |
[KEV] Out-of-Bounds Write in Apple Multiple Products (CVE-2024-23225)
Out-of-bounds write in Apple Multiple Products (CVE-2024-23225). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-36380 KEV |
[KEV] OS Command Injection in Sunhillo SureLine (CVE-2021-36380)
OS command injection in Sunhillo SureLine (CVE-2021-36380). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-21237 KEV |
[KEV] Information Disclosure in Android Pixel (CVE-2023-21237)
Vulnerability in Android Pixel (CVE-2023-21237). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-21338 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-21338)
Vulnerability in Microsoft Windows (CVE-2024-21338). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-29360 KEV |
[KEV] Vulnerability in Microsoft Streaming Service (CVE-2023-29360)
Vulnerability in Microsoft Streaming Service (CVE-2023-29360). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-1709 KEV |
[KEV] Vulnerability in ConnectWise ScreenConnect (CVE-2024-1709)
Vulnerability in ConnectWise ScreenConnect (CVE-2024-1709). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-21410 KEV |
[KEV] Authentication Bypass in Microsoft Exchange Server (CVE-2024-21410)
Authentication bypass in Microsoft Exchange Server (CVE-2024-21410). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-3259 KEV |
[KEV] Information Disclosure in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (CVE-2020-3259)
Vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) (CVE-2020-3259). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-21351 KEV |
[KEV] Code Injection in Microsoft Windows (CVE-2024-21351)
Code injection in Microsoft Windows (CVE-2024-21351). Data can be tampered with by attackers. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-21412 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2024-21412)
Vulnerability in Microsoft Windows (CVE-2024-21412). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-43770 KEV |
[KEV] Cross-Site Scripting (XSS) in Roundcube Webmail (CVE-2023-43770)
Cross-site scripting in Roundcube Webmail (CVE-2023-43770). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-21762 KEV |
[KEV] Out-of-Bounds Write in Fortinet FortiOS (CVE-2024-21762)
Out-of-bounds write in Fortinet FortiOS (CVE-2024-21762). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-4762 KEV |
[KEV] Vulnerability in Google Chromium V8 (CVE-2023-4762)
Vulnerability in Google Chromium V8 (CVE-2023-4762). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-21893 KEV |
[KEV] SSRF (Server-Side Request Forgery) in Ivanti Connect Secure, Policy Secure, and Neurons (CVE-2024-21893)
SSRF in Ivanti Connect Secure, Policy Secure, and Neurons (CVE-2024-21893). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2022-48618 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2022-48618)
Vulnerability in Apple Multiple Products (CVE-2022-48618). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-22527 KEV |
[KEV] Vulnerability in Atlassian Confluence Data Center and Server (CVE-2023-22527)
Vulnerability in Atlassian Confluence Data Center and Server (CVE-2023-22527). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-23222 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2024-23222)
Vulnerability in Apple Multiple Products (CVE-2024-23222). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-34048 KEV |
[KEV] Out-of-Bounds Write in VMware vCenter Server (CVE-2023-34048)
Out-of-bounds write in VMware vCenter Server (CVE-2023-34048). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-35082 KEV |
[KEV] Authentication Bypass in Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core (CVE-2023-35082)
Authentication bypass in Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core (CVE-2023-35082). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-6548 KEV |
[KEV] Code Injection in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-6548)
Code injection in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-6548). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-6549 KEV |
[KEV] Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-6549)
Vulnerability in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-6549). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-0519 KEV |
[KEV] Out-of-Bounds Write in Google Chromium V8 (CVE-2024-0519)
Out-of-bounds write in Google Chromium V8 (CVE-2024-0519). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-15133 KEV |
[KEV] Unsafe Deserialization in Laravel Framework (CVE-2018-15133)
Vulnerability in Laravel Framework (CVE-2018-15133). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2024-21887 KEV |
[KEV] Command Injection in Ivanti Connect Secure and Policy Secure (CVE-2024-21887)
Command injection in Ivanti Connect Secure and Policy Secure (CVE-2024-21887). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-46805 KEV |
[KEV] Authentication Bypass in Ivanti Connect Secure and Policy Secure (CVE-2023-46805)
Authentication bypass in Ivanti Connect Secure and Policy Secure (CVE-2023-46805). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-29357 KEV |
[KEV] Vulnerability in Microsoft SharePoint Server (CVE-2023-29357)
Vulnerability in Microsoft SharePoint Server (CVE-2023-29357). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-38203 KEV |
[KEV] Unsafe Deserialization in Adobe ColdFusion (CVE-2023-38203)
Vulnerability in Adobe ColdFusion (CVE-2023-38203). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-29300 KEV |
[KEV] Unsafe Deserialization in Adobe ColdFusion (CVE-2023-29300)
Vulnerability in Adobe ColdFusion (CVE-2023-29300). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-27524 KEV |
[KEV] Vulnerability in Apache Superset (CVE-2023-27524)
Vulnerability in Apache Superset (CVE-2023-27524). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 2.0.2 or later.
|
|
| CVE-2023-41990 KEV |
[KEV] Vulnerability in Apple Multiple Products (CVE-2023-41990)
Vulnerability in Apple Multiple Products (CVE-2023-41990). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-20017 KEV |
[KEV] Command Injection in D-Link DSL-2750B Devices (CVE-2016-20017)
Command injection in D-Link DSL-2750B Devices (CVE-2016-20017). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-23752 KEV |
[KEV] Vulnerability in Joomla! (CVE-2023-23752)
Vulnerability in Joomla! (CVE-2023-23752). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-7024 KEV |
[KEV] Out-of-Bounds Write in Google Chromium WebRTC (CVE-2023-7024)
Out-of-bounds write in Google Chromium WebRTC (CVE-2023-7024). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-7101 KEV |
[KEV] Vulnerability in Spreadsheet::ParseExcel (CVE-2023-7101)
Vulnerability in Spreadsheet::ParseExcel (CVE-2023-7101). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-47565 KEV |
[KEV] OS Command Injection in QNAP VioStor NVR (CVE-2023-47565)
OS command injection in QNAP VioStor NVR (CVE-2023-47565). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-49897 KEV |
[KEV] OS Command Injection in FXC AE1021, AE1021PE (CVE-2023-49897)
OS command injection in FXC AE1021, AE1021PE (CVE-2023-49897). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-6448 KEV |
[KEV] Vulnerability in Unitronics Vision PLC and HMI (CVE-2023-6448)
Vulnerability in Unitronics Vision PLC and HMI (CVE-2023-6448). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2023-41265 KEV |
[KEV] Vulnerability in Qlik Sense (CVE-2023-41265)
Vulnerability in Qlik Sense (CVE-2023-41265). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
