Known Exploited Vulnerabilities
The CISA catalogue of vulnerabilities with evidence of exploitation in the wild, newest additions first. Catalogue version 2026.11.10, released 2026-11-10 19:03 UTC.
1,779 entries
| Added | CVE | Vendor · product | Name | CVSS | Due | Ransomware |
|---|---|---|---|---|---|---|
| 2024-02-13 | CVE-2024-21412 | Microsoft · Windows | Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability | 8.1 High | 2024-03-05 | known |
| 2024-02-13 | CVE-2024-21351 | Microsoft · Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | 7.6 High | 2024-03-05 | unknown |
| 2024-02-12 | CVE-2023-43770 | Roundcube · Webmail | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 6.1 Medium | 2024-03-04 | unknown |
| 2024-02-09 | CVE-2024-21762 | Fortinet · FortiOS | Fortinet FortiOS Out-of-Bound Write Vulnerability | 9.6 Critical | 2024-02-16 | known |
| 2024-02-06 | CVE-2023-4762 | Google · Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 8.8 High | 2024-02-27 | unknown |
| 2024-01-31 | CVE-2024-21893 | Ivanti · Connect Secure, Policy Secure, and Neurons | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | 8.2 High | 2024-02-02 | known |
| 2024-01-31 | CVE-2022-48618 | Apple · Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 7.0 High | 2024-02-21 | unknown |
| 2024-01-24 | CVE-2023-22527 | Atlassian · Confluence Data Center and Server | Atlassian Confluence Data Center and Server Template Injection Vulnerability | 10.0 Critical | 2024-02-14 | known |
| 2024-01-23 | CVE-2024-23222 | Apple · Multiple Products | Apple Multiple Products WebKit Type Confusion Vulnerability | 8.8 High | 2024-02-13 | unknown |
| 2024-01-22 | CVE-2023-34048 | VMware · vCenter Server | VMware vCenter Server Out-of-Bounds Write Vulnerability | 9.8 Critical | 2024-02-12 | unknown |
| 2024-01-18 | CVE-2023-35082 | Ivanti · Endpoint Manager Mobile (EPMM) and MobileIron Core | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability | 10.0 Critical | 2024-02-08 | known |
| 2024-01-17 | CVE-2024-0519 | Google · Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Access Vulnerability | 8.8 High | 2024-02-07 | unknown |
| 2024-01-17 | CVE-2023-6549 | Citrix · NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | 8.2 High | 2024-02-07 | unknown |
| 2024-01-17 | CVE-2023-6548 | Citrix · NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | 5.5 Medium | 2024-01-24 | unknown |
| 2024-01-16 | CVE-2018-15133 | Laravel · Laravel Framework | Laravel Deserialization of Untrusted Data Vulnerability | 8.1 High | 2024-02-06 | unknown |
| 2024-01-10 | CVE-2024-21887 | Ivanti · Connect Secure and Policy Secure | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | 9.1 Critical | 2024-01-22 | known |
| 2024-01-10 | CVE-2023-46805 | Ivanti · Connect Secure and Policy Secure | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | 8.2 High | 2024-01-22 | known |
| 2024-01-10 | CVE-2023-29357 | Microsoft · SharePoint Server | Microsoft SharePoint Server Privilege Escalation Vulnerability | 9.8 Critical | 2024-01-31 | known |
| 2024-01-08 | CVE-2023-41990 | Apple · Multiple Products | Apple Multiple Products Code Execution Vulnerability | 7.8 High | 2024-01-29 | unknown |
| 2024-01-08 | CVE-2023-38203 | Adobe · ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2024-01-29 | known |
| 2024-01-08 | CVE-2023-29300 | Adobe · ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2024-01-29 | known |
| 2024-01-08 | CVE-2023-27524 | Apache · Superset | Apache Superset Insecure Default Initialization of Resource Vulnerability | 8.9 High | 2024-01-29 | unknown |
| 2024-01-08 | CVE-2023-23752 | Joomla! · Joomla! | Joomla! Improper Access Control Vulnerability | 5.3 Medium | 2024-01-29 | unknown |
| 2024-01-08 | CVE-2016-20017 | D-Link · DSL-2750B Devices | D-Link DSL-2750B Devices Command Injection Vulnerability | 9.8 Critical | 2024-01-29 | unknown |
| 2024-01-02 | CVE-2023-7101 | Spreadsheet::ParseExcel · Spreadsheet::ParseExcel | Spreadsheet::ParseExcel Remote Code Execution Vulnerability | 7.8 High | 2024-01-23 | unknown |
| 2024-01-02 | CVE-2023-7024 | Google · Chromium WebRTC | Google Chromium WebRTC Heap Buffer Overflow Vulnerability | 8.8 High | 2024-01-23 | unknown |
| 2023-12-21 | CVE-2023-49897 | FXC · AE1021, AE1021PE | FXC AE1021, AE1021PE OS Command Injection Vulnerability | 8.8 High | 2024-01-11 | unknown |
| 2023-12-21 | CVE-2023-47565 | QNAP · VioStor NVR | QNAP VioStor NVR OS Command Injection Vulnerability | 8.0 High | 2024-01-11 | unknown |
| 2023-12-11 | CVE-2023-6448 | Unitronics · Vision PLC and HMI | Unitronics Vision PLC and HMI Insecure Default Password Vulnerability | 9.8 Critical | 2023-12-18 | unknown |
| 2023-12-07 | CVE-2023-41266 | Qlik · Sense | Qlik Sense Path Traversal Vulnerability | 8.2 High | 2023-12-28 | known |
| 2023-12-07 | CVE-2023-41265 | Qlik · Sense | Qlik Sense HTTP Tunneling Vulnerability | 9.6 Critical | 2023-12-28 | known |
| 2023-12-05 | CVE-2023-33107 | Qualcomm · Multiple Chipsets | Qualcomm Multiple Chipsets Integer Overflow Vulnerability | 8.4 High | 2023-12-26 | unknown |
| 2023-12-05 | CVE-2023-33106 | Qualcomm · Multiple Chipsets | Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability | 8.4 High | 2023-12-26 | unknown |
| 2023-12-05 | CVE-2023-33063 | Qualcomm · Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 7.8 High | 2023-12-26 | unknown |
| 2023-12-05 | CVE-2022-22071 | Qualcomm · Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 8.4 High | 2023-12-26 | unknown |
| 2023-12-04 | CVE-2023-42917 | Apple · Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability | 8.8 High | 2023-12-25 | unknown |
| 2023-12-04 | CVE-2023-42916 | Apple · Multiple Products | Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability | 6.5 Medium | 2023-12-25 | unknown |
| 2023-11-30 | CVE-2023-6345 | Google · Chromium Skia | Google Skia Integer Overflow Vulnerability | 9.6 Critical | 2023-12-21 | unknown |
| 2023-11-30 | CVE-2023-49103 | ownCloud · ownCloud graphapi | ownCloud graphapi Information Disclosure Vulnerability | 10.0 Critical | 2023-12-21 | unknown |
| 2023-11-21 | CVE-2023-4911 | GNU · GNU C Library | GNU C Library Buffer Overflow Vulnerability | 7.8 High | 2023-12-12 | unknown |
| 2023-11-16 | CVE-2023-36584 | Microsoft · Windows | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | 5.4 Medium | 2023-12-07 | unknown |
| 2023-11-16 | CVE-2023-1671 | Sophos · Web Appliance | Sophos Web Appliance Command Injection Vulnerability | 9.8 Critical | 2023-12-07 | unknown |
| 2023-11-16 | CVE-2020-2551 | Oracle · Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 9.8 Critical | 2023-12-07 | unknown |
| 2023-11-14 | CVE-2023-36036 | Microsoft · Windows | Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability | 7.8 High | 2023-12-05 | unknown |
| 2023-11-14 | CVE-2023-36033 | Microsoft · Windows | Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | 7.8 High | 2023-12-05 | unknown |
| 2023-11-14 | CVE-2023-36025 | Microsoft · Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | 8.8 High | 2023-12-05 | unknown |
| 2023-11-13 | CVE-2023-47246 | SysAid · SysAid Server | SysAid Server Path Traversal Vulnerability | 9.8 Critical | 2023-12-04 | known |
| 2023-11-13 | CVE-2023-36851 | Juniper · Junos OS | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | 5.3 Medium | 2023-11-17 | unknown |
| 2023-11-13 | CVE-2023-36847 | Juniper · Junos OS | Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability | 5.3 Medium | 2023-11-17 | unknown |
| 2023-11-13 | CVE-2023-36846 | Juniper · Junos OS | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | 5.3 Medium | 2023-11-17 | unknown |
| 2023-11-13 | CVE-2023-36845 | Juniper · Junos OS | Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability | 9.8 Critical | 2023-11-17 | unknown |
| 2023-11-13 | CVE-2023-36844 | Juniper · Junos OS | Juniper Junos OS EX Series PHP External Variable Modification Vulnerability | 5.3 Medium | 2023-11-17 | unknown |
| 2023-11-08 | CVE-2023-29552 | IETF · Service Location Protocol (SLP) | Service Location Protocol (SLP) Denial-of-Service Vulnerability | 7.5 High | 2023-11-29 | unknown |
| 2023-11-07 | CVE-2023-22518 | Atlassian · Confluence Data Center and Server | Atlassian Confluence Data Center and Server Improper Authorization Vulnerability | 10.0 Critical | 2023-11-28 | known |
| 2023-11-02 | CVE-2023-46604 | Apache · ActiveMQ | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | 10.0 Critical | 2023-11-23 | known |
| 2023-10-31 | CVE-2023-46748 | F5 · BIG-IP Configuration Utility | F5 BIG-IP Configuration Utility SQL Injection Vulnerability | 8.8 High | 2023-11-21 | unknown |
| 2023-10-31 | CVE-2023-46747 | F5 · BIG-IP Configuration Utility | F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability | 9.8 Critical | 2023-11-21 | known |
| 2023-10-26 | CVE-2023-5631 | Roundcube · Webmail | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 6.1 Medium | 2023-11-16 | unknown |
| 2023-10-23 | CVE-2023-20273 | Cisco · Cisco IOS XE Web UI | Cisco IOS XE Web UI Command Injection Vulnerability | 7.2 High | 2023-10-27 | unknown |
| 2023-10-18 | CVE-2023-4966 | Citrix · NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | 9.4 Critical | 2023-11-08 | known |
| 2023-10-16 | CVE-2023-20198 | Cisco · IOS XE Web UI | Cisco IOS XE Web UI Privilege Escalation Vulnerability | 10.0 Critical | 2023-10-20 | unknown |
| 2023-10-10 | CVE-2023-44487 | IETF · HTTP/2 | HTTP/2 Rapid Reset Attack Vulnerability | 7.5 High | 2023-10-31 | unknown |
| 2023-10-10 | CVE-2023-41763 | Microsoft · Skype for Business | Microsoft Skype for Business Privilege Escalation Vulnerability | 5.3 Medium | 2023-10-31 | unknown |
| 2023-10-10 | CVE-2023-36563 | Microsoft · WordPad | Microsoft WordPad Information Disclosure Vulnerability | 6.5 Medium | 2023-10-31 | unknown |
| 2023-10-10 | CVE-2023-21608 | Adobe · Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 7.8 High | 2023-10-31 | unknown |
| 2023-10-10 | CVE-2023-20109 | Cisco · IOS and IOS XE | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | 6.6 Medium | 2023-10-31 | unknown |
| 2023-10-05 | CVE-2023-42824 | Apple · iOS and iPadOS | Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability | 7.8 High | 2023-10-26 | unknown |
| 2023-10-05 | CVE-2023-40044 | Progress · WS_FTP Server | Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | 10.0 Critical | 2023-10-26 | known |
| 2023-10-05 | CVE-2023-22515 | Atlassian · Confluence Data Center and Server | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | 10.0 Critical | 2023-10-13 | known |
| 2023-10-04 | CVE-2023-42793 | JetBrains · TeamCity | JetBrains TeamCity Authentication Bypass Vulnerability | 9.8 Critical | 2023-10-25 | known |
| 2023-10-04 | CVE-2023-28229 | Microsoft · Windows CNG Key Isolation Service | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | 7.0 High | 2023-10-25 | unknown |
| 2023-10-03 | CVE-2023-4211 | Arm · Mali GPU Kernel Driver | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | 5.5 Medium | 2023-10-24 | unknown |
| 2023-10-02 | CVE-2023-5217 | Google · Chromium libvpx | Google Chromium libvpx Heap Buffer Overflow Vulnerability | 8.8 High | 2023-10-23 | unknown |
| 2023-09-28 | CVE-2018-14667 | Red Hat · JBoss RichFaces Framework | Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability | 9.8 Critical | 2023-10-19 | unknown |
| 2023-09-25 | CVE-2023-41993 | Apple · Multiple Products | Apple Multiple Products WebKit Code Execution Vulnerability | 8.8 High | 2023-10-16 | unknown |
| 2023-09-25 | CVE-2023-41992 | Apple · Multiple Products | Apple Multiple Products Kernel Privilege Escalation Vulnerability | 7.8 High | 2023-10-16 | unknown |
| 2023-09-25 | CVE-2023-41991 | Apple · Multiple Products | Apple Multiple Products Improper Certificate Validation Vulnerability | 5.5 Medium | 2023-10-16 | unknown |
| 2023-09-21 | CVE-2023-41179 | Trend Micro · Apex One and Worry-Free Business Security | Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability | 7.2 High | 2023-10-12 | unknown |
| 2023-09-19 | CVE-2023-28434 | MinIO · MinIO | MinIO Security Feature Bypass Vulnerability | 8.8 High | 2023-10-10 | unknown |
| 2023-09-18 | CVE-2022-22265 | Samsung · Mobile Devices | Samsung Mobile Devices Use-After-Free Vulnerability | 5.0 Medium | 2023-10-09 | unknown |
| 2023-09-18 | CVE-2021-3129 | Laravel · Ignition | Laravel Ignition File Upload Vulnerability | 9.8 Critical | 2023-10-09 | known |
| 2023-09-18 | CVE-2017-6884 | Zyxel · EMG2926 Routers | Zyxel EMG2926 Routers Command Injection Vulnerability | 8.8 High | 2023-10-09 | known |
| 2023-09-18 | CVE-2014-8361 | Realtek · SDK | Realtek SDK Improper Input Validation Vulnerability | 9.8 Critical | 2023-10-09 | unknown |
| 2023-09-14 | CVE-2023-26369 | Adobe · Acrobat and Reader | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | 7.8 High | 2023-10-05 | unknown |
| 2023-09-13 | CVE-2023-4863 | Google · Chromium WebP | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability | 8.8 High | 2023-10-04 | unknown |
| 2023-09-13 | CVE-2023-35674 | Android · Framework | Android Framework Privilege Escalation Vulnerability | 8.8 High | 2023-10-04 | unknown |
| 2023-09-13 | CVE-2023-20269 | Cisco · Adaptive Security Appliance and Firepower Threat Defense | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | 5.0 Medium | 2023-10-04 | known |
| 2023-09-12 | CVE-2023-36802 | Microsoft · Streaming Service Proxy | Microsoft Streaming Service Proxy Privilege Escalation Vulnerability | 7.8 High | 2023-10-03 | unknown |
| 2023-09-12 | CVE-2023-36761 | Microsoft · Word | Microsoft Word Information Disclosure Vulnerability | 6.5 Medium | 2023-10-03 | unknown |
| 2023-09-11 | CVE-2023-41064 | Apple · iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability | 7.8 High | 2023-10-02 | unknown |
| 2023-09-11 | CVE-2023-41061 | Apple · iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability | 7.8 High | 2023-10-02 | unknown |
| 2023-09-06 | CVE-2023-33246 | Apache · RocketMQ | Apache RocketMQ Command Execution Vulnerability | 9.8 Critical | 2023-09-27 | unknown |
| 2023-08-24 | CVE-2023-38831 | RARLAB · WinRAR | RARLAB WinRAR Code Execution Vulnerability | 7.8 High | 2023-09-14 | known |
| 2023-08-24 | CVE-2023-32315 | Ignite Realtime · Openfire | Ignite Realtime Openfire Path Traversal Vulnerability | 8.6 High | 2023-09-14 | unknown |
| 2023-08-22 | CVE-2023-38035 | Ivanti · Sentry | Ivanti Sentry Authentication Bypass Vulnerability | 9.8 Critical | 2023-09-12 | known |
| 2023-08-22 | CVE-2023-27532 | Veeam · Backup & Replication | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | 7.5 High | 2023-09-12 | known |
| 2023-08-21 | CVE-2023-26359 | Adobe · ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 9.8 Critical | 2023-09-11 | unknown |
| 2023-08-16 | CVE-2023-24489 | Citrix · Content Collaboration | Citrix Content Collaboration ShareFile Improper Access Control Vulnerability | 9.8 Critical | 2023-09-06 | unknown |
| 2023-08-09 | CVE-2023-38180 | Microsoft · .NET Core and Visual Studio | Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability | 7.5 High | 2023-08-30 | unknown |
| 2023-08-07 | CVE-2017-18368 | Zyxel · P660HN-T1A Routers | Zyxel P660HN-T1A Routers Command Injection Vulnerability | 9.8 Critical | 2023-08-28 | unknown |
Source: CISA Known Exploited Vulnerabilities Catalog (cisa.gov). Due dates are the remediation deadlines CISA sets for US federal civilian agencies.