Known Exploited Vulnerabilities
The CISA catalogue of vulnerabilities with evidence of exploitation in the wild, newest additions first. Catalogue version 2026.11.10, released 2026-11-10 19:03 UTC.
1,779 entries
| Added | CVE | Vendor · product | Name | CVSS | Due | Ransomware |
|---|---|---|---|---|---|---|
| 2024-09-18 | CVE-2024-27348 | Apache · HugeGraph-Server | Apache HugeGraph-Server Improper Access Control Vulnerability | 9.8 Critical | 2024-10-09 | unknown |
| 2024-09-18 | CVE-2022-21445 | Oracle · ADF Faces | Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2024-10-09 | unknown |
| 2024-09-18 | CVE-2020-14644 | Oracle · WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | 9.8 Critical | 2024-10-09 | unknown |
| 2024-09-18 | CVE-2020-0618 | Microsoft · SQL Server | Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability | 9.8 Critical | 2024-10-09 | known |
| 2024-09-17 | CVE-2014-0502 | Adobe · Flash Player | Adobe Flash Player Double Free Vulnerablity | 8.8 High | 2024-10-08 | unknown |
| 2024-09-17 | CVE-2014-0497 | Adobe · Flash Player | Adobe Flash Player Integer Underflow Vulnerablity | 8.8 High | 2024-10-08 | unknown |
| 2024-09-17 | CVE-2013-0648 | Adobe · Flash Player | Adobe Flash Player Code Execution Vulnerability | 8.8 High | 2024-10-08 | unknown |
| 2024-09-17 | CVE-2013-0643 | Adobe · Flash Player | Adobe Flash Player Incorrect Default Permissions Vulnerability | 8.8 High | 2024-10-08 | unknown |
| 2024-09-16 | CVE-2024-6670 | Progress · WhatsUp Gold | Progress WhatsUp Gold SQL Injection Vulnerability | 9.8 Critical | 2024-10-07 | known |
| 2024-09-16 | CVE-2024-43461 | Microsoft · Windows | Microsoft Windows MSHTML Platform Spoofing Vulnerability | 8.8 High | 2024-10-07 | unknown |
| 2024-09-13 | CVE-2024-8190 | Ivanti · Cloud Services Appliance | Ivanti Cloud Services Appliance OS Command Injection Vulnerability | 7.2 High | 2024-10-04 | unknown |
| 2024-09-10 | CVE-2024-38226 | Microsoft · Publisher | Microsoft Publisher Protection Mechanism Failure Vulnerability | 7.3 High | 2024-10-01 | unknown |
| 2024-09-10 | CVE-2024-38217 | Microsoft · Windows | Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability | 5.4 Medium | 2024-10-01 | unknown |
| 2024-09-10 | CVE-2024-38014 | Microsoft · Windows | Microsoft Windows Installer Improper Privilege Management Vulnerability | 7.8 High | 2024-10-01 | unknown |
| 2024-09-09 | CVE-2024-40766 | SonicWall · SonicOS | SonicWall SonicOS Improper Access Control Vulnerability | 9.3 Critical | 2024-09-30 | known |
| 2024-09-09 | CVE-2017-1000253 | Linux · Kernel | Linux Kernel PIE Stack Buffer Corruption Vulnerability | 7.8 High | 2024-09-30 | known |
| 2024-09-09 | CVE-2016-3714 | ImageMagick · ImageMagick | ImageMagick Improper Input Validation Vulnerability | 8.4 High | 2024-09-30 | unknown |
| 2024-09-03 | CVE-2024-7262 | Kingsoft · WPS Office | Kingsoft WPS Office Path Traversal Vulnerability | 9.3 Critical | 2024-09-24 | unknown |
| 2024-09-03 | CVE-2021-20124 | DrayTek · VigorConnect | Draytek VigorConnect Path Traversal Vulnerability | 7.5 High | 2024-09-24 | unknown |
| 2024-09-03 | CVE-2021-20123 | DrayTek · VigorConnect | Draytek VigorConnect Path Traversal Vulnerability | 7.5 High | 2024-09-24 | unknown |
| 2024-08-28 | CVE-2024-7965 | Google · Chromium V8 | Google Chromium V8 Inappropriate Implementation Vulnerability | 8.8 High | 2024-09-18 | unknown |
| 2024-08-27 | CVE-2024-38856 | Apache · OFBiz | Apache OFBiz Incorrect Authorization Vulnerability | 8.1 High | 2024-09-17 | unknown |
| 2024-08-26 | CVE-2024-7971 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2024-09-16 | unknown |
| 2024-08-23 | CVE-2024-39717 | Versa · Director | Versa Director Dangerous File Type Upload Vulnerability | 6.6 Medium | 2024-09-13 | unknown |
| 2024-08-21 | CVE-2022-0185 | Linux · Kernel | Linux Kernel Heap-Based Buffer Overflow Vulnerability | 8.4 High | 2024-09-11 | unknown |
| 2024-08-21 | CVE-2021-33045 | Dahua · IP Camera Firmware | Dahua IP Camera Authentication Bypass Vulnerability | 9.8 Critical | 2024-09-11 | unknown |
| 2024-08-21 | CVE-2021-33044 | Dahua · IP Camera Firmware | Dahua IP Camera Authentication Bypass Vulnerability | 9.8 Critical | 2024-09-11 | unknown |
| 2024-08-21 | CVE-2021-31196 | Microsoft · Exchange Server | Microsoft Exchange Server Information Disclosure Vulnerability | 7.2 High | 2024-09-11 | unknown |
| 2024-08-19 | CVE-2024-23897 | Jenkins · Jenkins Command Line Interface (CLI) | Jenkins Command Line Interface (CLI) Path Traversal Vulnerability | 9.8 Critical | 2024-09-09 | known |
| 2024-08-15 | CVE-2024-28986 | SolarWinds · Web Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2024-09-05 | unknown |
| 2024-08-13 | CVE-2024-38213 | Microsoft · Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | 6.5 Medium | 2024-09-03 | unknown |
| 2024-08-13 | CVE-2024-38193 | Microsoft · Windows | Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability | 7.8 High | 2024-09-03 | unknown |
| 2024-08-13 | CVE-2024-38189 | Microsoft · Project | Microsoft Project Remote Code Execution Vulnerability | 8.8 High | 2024-09-03 | unknown |
| 2024-08-13 | CVE-2024-38178 | Microsoft · Windows | Microsoft Windows Scripting Engine Memory Corruption Vulnerability | 7.5 High | 2024-09-03 | unknown |
| 2024-08-13 | CVE-2024-38107 | Microsoft · Windows | Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability | 7.8 High | 2024-09-03 | unknown |
| 2024-08-13 | CVE-2024-38106 | Microsoft · Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | 7.0 High | 2024-09-03 | unknown |
| 2024-08-07 | CVE-2024-36971 | Android · Kernel | Android Kernel Remote Code Execution Vulnerability | 7.8 High | 2024-08-28 | unknown |
| 2024-08-07 | CVE-2024-32113 | Apache · OFBiz | Apache OFBiz Path Traversal Vulnerability | 9.1 Critical | 2024-08-28 | unknown |
| 2024-08-05 | CVE-2018-0824 | Microsoft · Windows | Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability | 7.5 High | 2024-08-26 | unknown |
| 2024-07-30 | CVE-2024-37085 | VMware · ESXi | VMware ESXi Authentication Bypass Vulnerability | 6.8 Medium | 2024-08-20 | known |
| 2024-07-29 | CVE-2024-5217 | ServiceNow · Utah, Vancouver, and Washington DC Now Platform | ServiceNow Incomplete List of Disallowed Inputs Vulnerability | 9.2 Critical | 2024-08-19 | unknown |
| 2024-07-29 | CVE-2024-4879 | ServiceNow · Utah, Vancouver, and Washington DC Now Platform | ServiceNow Improper Input Validation Vulnerability | 9.3 Critical | 2024-08-19 | unknown |
| 2024-07-29 | CVE-2023-45249 | Acronis · Cyber Infrastructure (ACI) | Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability | 9.8 Critical | 2024-08-19 | unknown |
| 2024-07-23 | CVE-2024-39891 | Twilio · Authy | Twilio Authy Information Disclosure Vulnerability | 5.3 Medium | 2024-08-13 | unknown |
| 2024-07-23 | CVE-2012-4792 | Microsoft · Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | 8.8 High | 2024-08-13 | unknown |
| 2024-07-17 | CVE-2024-34102 | Adobe · Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | 9.8 Critical | 2024-08-07 | unknown |
| 2024-07-17 | CVE-2024-28995 | SolarWinds · Serv-U | SolarWinds Serv-U Path Traversal Vulnerability | 8.6 High | 2024-08-07 | unknown |
| 2024-07-17 | CVE-2022-22948 | VMware · vCenter Server | VMware vCenter Server Incorrect Default File Permissions Vulnerability | 6.5 Medium | 2024-08-07 | unknown |
| 2024-07-15 | CVE-2024-36401 | OSGeo · GeoServer | OSGeo GeoServer GeoTools Eval Injection Vulnerability | 9.8 Critical | 2024-08-05 | unknown |
| 2024-07-09 | CVE-2024-38112 | Microsoft · Windows | Microsoft Windows MSHTML Platform Spoofing Vulnerability | 7.5 High | 2024-07-30 | unknown |
| 2024-07-09 | CVE-2024-38080 | Microsoft · Windows | Microsoft Windows Hyper-V Privilege Escalation Vulnerability | 7.8 High | 2024-07-30 | unknown |
| 2024-07-09 | CVE-2024-23692 | Rejetto · HTTP File Server | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | 9.8 Critical | 2024-07-30 | known |
| 2024-07-02 | CVE-2024-20399 | Cisco · NX-OS | Cisco NX-OS Command Injection Vulnerability | 6.0 Medium | 2024-07-23 | unknown |
| 2024-06-26 | CVE-2022-2586 | Linux · Kernel | Linux Kernel Use-After-Free Vulnerability | 5.3 Medium | 2024-07-17 | unknown |
| 2024-06-26 | CVE-2022-24816 | OSGeo · JAI-EXT | OSGeo GeoServer JAI-EXT Code Injection Vulnerability | 10.0 Critical | 2024-07-17 | unknown |
| 2024-06-26 | CVE-2020-13965 | Roundcube · Webmail | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | 6.3 Medium | 2024-07-17 | unknown |
| 2024-06-13 | CVE-2024-4358 | Progress · Telerik Report Server | Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability | 9.8 Critical | 2024-07-04 | unknown |
| 2024-06-13 | CVE-2024-32896 | Android · Pixel | Android Pixel Privilege Escalation Vulnerability | 8.1 High | 2024-07-04 | unknown |
| 2024-06-13 | CVE-2024-26169 | Microsoft · Windows | Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability | 7.8 High | 2024-07-04 | known |
| 2024-06-12 | CVE-2024-4610 | Arm · Mali GPU Kernel Driver | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | 7.4 High | 2024-07-03 | unknown |
| 2024-06-12 | CVE-2024-4577 | PHP Group · PHP | PHP-CGI OS Command Injection Vulnerability | 9.8 Critical | 2024-07-03 | known |
| 2024-06-03 | CVE-2017-3506 | Oracle · WebLogic Server | Oracle WebLogic Server OS Command Injection Vulnerability | 7.4 High | 2024-06-24 | unknown |
| 2024-05-30 | CVE-2024-24919 | Check Point · Quantum Security Gateways | Check Point Quantum Security Gateways Information Disclosure Vulnerability | 8.6 High | 2024-06-20 | known |
| 2024-05-30 | CVE-2024-1086 | Linux · Kernel | Linux Kernel Use-After-Free Vulnerability | 7.8 High | 2024-06-20 | known |
| 2024-05-29 | CVE-2024-4978 | Justice AV Solutions · Viewer | Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability | 8.7 High | 2024-06-19 | unknown |
| 2024-05-28 | CVE-2024-5274 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.3 High | 2024-06-18 | unknown |
| 2024-05-23 | CVE-2020-17519 | Apache · Flink | Apache Flink Improper Access Control Vulnerability | 9.1 Critical | 2024-06-13 | unknown |
| 2024-05-20 | CVE-2024-4947 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 9.6 Critical | 2024-06-10 | unknown |
| 2024-05-20 | CVE-2023-43208 | NextGen Healthcare · Mirth Connect | NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2024-06-10 | known |
| 2024-05-16 | CVE-2024-4761 | Google · Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Write Vulnerability | 8.3 High | 2024-06-06 | unknown |
| 2024-05-16 | CVE-2021-40655 | D-Link · DIR-605 Router | D-Link DIR-605 Router Information Disclosure Vulnerability | 7.5 High | 2024-06-06 | unknown |
| 2024-05-16 | CVE-2014-100005 | D-Link · DIR-600 Router | D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability | 8.0 High | 2024-06-06 | unknown |
| 2024-05-14 | CVE-2024-30051 | Microsoft · DWM Core Library | Microsoft DWM Core Library Privilege Escalation Vulnerability | 7.8 High | 2024-06-04 | known |
| 2024-05-14 | CVE-2024-30040 | Microsoft · Windows | Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability | 8.8 High | 2024-06-04 | unknown |
| 2024-05-13 | CVE-2024-4671 | Google · Chromium | Google Chromium Visuals Use-After-Free Vulnerability | 9.6 Critical | 2024-06-03 | unknown |
| 2024-05-01 | CVE-2023-7028 | GitLab · GitLab CE/EE | GitLab Community and Enterprise Editions Improper Access Control Vulnerability | 10.0 Critical | 2024-05-22 | unknown |
| 2024-04-30 | CVE-2024-29988 | Microsoft · SmartScreen Prompt | Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability | 8.8 High | 2024-05-21 | unknown |
| 2024-04-24 | CVE-2024-4040 | CrushFTP · CrushFTP | CrushFTP VFS Sandbox Escape Vulnerability | 9.8 Critical | 2024-05-01 | unknown |
| 2024-04-24 | CVE-2024-20359 | Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Privilege Escalation Vulnerability | 6.0 Medium | 2024-05-01 | unknown |
| 2024-04-24 | CVE-2024-20353 | Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Denial of Service Vulnerability | 8.6 High | 2024-05-01 | unknown |
| 2024-04-23 | CVE-2022-38028 | Microsoft · Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 7.8 High | 2024-05-14 | unknown |
| 2024-04-12 | CVE-2024-3400 | Palo Alto Networks · PAN-OS | Palo Alto Networks PAN-OS Command Injection Vulnerability | 10.0 Critical | 2024-04-19 | known |
| 2024-04-11 | CVE-2024-3273 | D-Link · Multiple NAS Devices | D-Link Multiple NAS Devices Command Injection Vulnerability | 7.3 High | 2024-05-02 | unknown |
| 2024-04-11 | CVE-2024-3272 | D-Link · Multiple NAS Devices | D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability | 9.8 Critical | 2024-05-02 | unknown |
| 2024-04-04 | CVE-2024-29748 | Android · Pixel | Android Pixel Privilege Escalation Vulnerability | 7.8 High | 2024-04-25 | unknown |
| 2024-04-04 | CVE-2024-29745 | Android · Pixel | Android Pixel Information Disclosure Vulnerability | 5.5 Medium | 2024-04-25 | unknown |
| 2024-03-26 | CVE-2023-24955 | Microsoft · SharePoint Server | Microsoft SharePoint Server Code Injection Vulnerability | 7.2 High | 2024-04-16 | known |
| 2024-03-25 | CVE-2023-48788 | Fortinet · FortiClient EMS | Fortinet FortiClient EMS SQL Injection Vulnerability | 9.3 Critical | 2024-04-15 | known |
| 2024-03-25 | CVE-2021-44529 | Ivanti · Endpoint Manager Cloud Service Appliance (EPM CSA) | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability | 9.8 Critical | 2024-04-15 | known |
| 2024-03-25 | CVE-2019-7256 | Nice · Linear eMerge E3-Series | Nice Linear eMerge E3-Series OS Command Injection Vulnerability | 9.8 Critical | 2024-04-15 | unknown |
| 2024-03-07 | CVE-2024-27198 | JetBrains · TeamCity | JetBrains TeamCity Authentication Bypass Vulnerability | 9.8 Critical | 2024-03-28 | known |
| 2024-03-06 | CVE-2024-23296 | Apple · Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 7.8 High | 2024-03-27 | unknown |
| 2024-03-06 | CVE-2024-23225 | Apple · Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 7.8 High | 2024-03-27 | unknown |
| 2024-03-05 | CVE-2023-21237 | Android · Pixel | Android Pixel Information Disclosure Vulnerability | 6.2 Medium | 2024-03-26 | unknown |
| 2024-03-05 | CVE-2021-36380 | Sunhillo · SureLine | Sunhillo SureLine OS Command Injection Vulnerablity | 9.8 Critical | 2024-03-26 | unknown |
| 2024-03-04 | CVE-2024-21338 | Microsoft · Windows | Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability | 7.8 High | 2024-03-25 | known |
| 2024-02-29 | CVE-2023-29360 | Microsoft · Streaming Service | Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability | 8.4 High | 2024-03-21 | unknown |
| 2024-02-22 | CVE-2024-1709 | ConnectWise · ScreenConnect | ConnectWise ScreenConnect Authentication Bypass Vulnerability | 10.0 Critical | 2024-02-29 | known |
| 2024-02-15 | CVE-2024-21410 | Microsoft · Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | 9.8 Critical | 2024-03-07 | unknown |
| 2024-02-15 | CVE-2020-3259 | Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Information Disclosure Vulnerability | 7.5 High | 2024-03-07 | known |
Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Due dates are the remediation deadlines CISA sets for US federal civilian agencies.