Known exploited vulnerabilities
From CISA’s Known Exploited Vulnerabilities catalogue: flaws that attackers are using now, when each was added, and the date federal agencies were told to fix it by.
- In the catalogue
- 1781
- Added in the last 7 days
- 12
- Used in ransomware
- 361
The catalogue, newest first
| CVE | Vendor | Product | Name | Added | Fix due | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2020-3259 | Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Information Disclosure Vulnerability | 15 Feb 2024 | 7 Mar 2024 | Known |
| CVE-2024-21410 | Microsoft | Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | 15 Feb 2024 | 7 Mar 2024 | Unknown |
| CVE-2024-21351 | Microsoft | Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | 13 Feb 2024 | 5 Mar 2024 | Unknown |
| CVE-2024-21412 | Microsoft | Windows | Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability | 13 Feb 2024 | 5 Mar 2024 | Known |
| CVE-2023-43770 | Roundcube | Webmail | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 12 Feb 2024 | 4 Mar 2024 | Unknown |
| CVE-2024-21762 | Fortinet | FortiOS | Fortinet FortiOS Out-of-Bound Write Vulnerability | 9 Feb 2024 | 16 Feb 2024 | Known |
| CVE-2023-4762 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 6 Feb 2024 | 27 Feb 2024 | Unknown | |
| CVE-2022-48618 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | 31 Jan 2024 | 21 Feb 2024 | Unknown |
| CVE-2024-21893 | Ivanti | Connect Secure, Policy Secure, and Neurons | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | 31 Jan 2024 | 2 Feb 2024 | Known |
| CVE-2023-22527 | Atlassian | Confluence Data Center and Server | Atlassian Confluence Data Center and Server Template Injection Vulnerability | 24 Jan 2024 | 14 Feb 2024 | Known |
| CVE-2024-23222 | Apple | Multiple Products | Apple Multiple Products WebKit Type Confusion Vulnerability | 23 Jan 2024 | 13 Feb 2024 | Unknown |
| CVE-2023-34048 | VMware | vCenter Server | VMware vCenter Server Out-of-Bounds Write Vulnerability | 22 Jan 2024 | 12 Feb 2024 | Unknown |
| CVE-2023-35082 | Ivanti | Endpoint Manager Mobile (EPMM) and MobileIron Core | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability | 18 Jan 2024 | 8 Feb 2024 | Known |
| CVE-2023-6548 | Citrix | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | 17 Jan 2024 | 24 Jan 2024 | Unknown |
| CVE-2023-6549 | Citrix | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | 17 Jan 2024 | 7 Feb 2024 | Unknown |
| CVE-2024-0519 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Access Vulnerability | 17 Jan 2024 | 7 Feb 2024 | Unknown | |
| CVE-2018-15133 | Laravel | Laravel Framework | Laravel Deserialization of Untrusted Data Vulnerability | 16 Jan 2024 | 6 Feb 2024 | Unknown |
| CVE-2023-29357 | Microsoft | SharePoint Server | Microsoft SharePoint Server Privilege Escalation Vulnerability | 10 Jan 2024 | 31 Jan 2024 | Known |
| CVE-2023-46805 | Ivanti | Connect Secure and Policy Secure | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | 10 Jan 2024 | 22 Jan 2024 | Known |
| CVE-2024-21887 | Ivanti | Connect Secure and Policy Secure | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | 10 Jan 2024 | 22 Jan 2024 | Known |
| CVE-2016-20017 | D-Link | DSL-2750B Devices | D-Link DSL-2750B Devices Command Injection Vulnerability | 8 Jan 2024 | 29 Jan 2024 | Unknown |
| CVE-2023-23752 | Joomla! | Joomla! | Joomla! Improper Access Control Vulnerability | 8 Jan 2024 | 29 Jan 2024 | Unknown |
| CVE-2023-27524 | Apache | Superset | Apache Superset Insecure Default Initialization of Resource Vulnerability | 8 Jan 2024 | 29 Jan 2024 | Unknown |
| CVE-2023-29300 | Adobe | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 8 Jan 2024 | 29 Jan 2024 | Known |
| CVE-2023-38203 | Adobe | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 8 Jan 2024 | 29 Jan 2024 | Known |
| CVE-2023-41990 | Apple | Multiple Products | Apple Multiple Products Code Execution Vulnerability | 8 Jan 2024 | 29 Jan 2024 | Unknown |
| CVE-2023-7024 | Chromium WebRTC | Google Chromium WebRTC Heap Buffer Overflow Vulnerability | 2 Jan 2024 | 23 Jan 2024 | Unknown | |
| CVE-2023-7101 | Spreadsheet::ParseExcel | Spreadsheet::ParseExcel | Spreadsheet::ParseExcel Remote Code Execution Vulnerability | 2 Jan 2024 | 23 Jan 2024 | Unknown |
| CVE-2023-47565 | QNAP | VioStor NVR | QNAP VioStor NVR OS Command Injection Vulnerability | 21 Dec 2023 | 11 Jan 2024 | Unknown |
| CVE-2023-49897 | FXC | AE1021, AE1021PE | FXC AE1021, AE1021PE OS Command Injection Vulnerability | 21 Dec 2023 | 11 Jan 2024 | Unknown |
| CVE-2023-6448 | Unitronics | Vision PLC and HMI | Unitronics Vision PLC and HMI Insecure Default Password Vulnerability | 11 Dec 2023 | 18 Dec 2023 | Unknown |
| CVE-2023-41265 | Qlik | Sense | Qlik Sense HTTP Tunneling Vulnerability | 7 Dec 2023 | 28 Dec 2023 | Known |
| CVE-2023-41266 | Qlik | Sense | Qlik Sense Path Traversal Vulnerability | 7 Dec 2023 | 28 Dec 2023 | Known |
| CVE-2022-22071 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 5 Dec 2023 | 26 Dec 2023 | Unknown |
| CVE-2023-33063 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 5 Dec 2023 | 26 Dec 2023 | Unknown |
| CVE-2023-33106 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability | 5 Dec 2023 | 26 Dec 2023 | Unknown |
| CVE-2023-33107 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Integer Overflow Vulnerability | 5 Dec 2023 | 26 Dec 2023 | Unknown |
| CVE-2023-42916 | Apple | Multiple Products | Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability | 4 Dec 2023 | 25 Dec 2023 | Unknown |
| CVE-2023-42917 | Apple | Multiple Products | Apple Multiple Products WebKit Memory Corruption Vulnerability | 4 Dec 2023 | 25 Dec 2023 | Unknown |
| CVE-2023-49103 | ownCloud | ownCloud graphapi | ownCloud graphapi Information Disclosure Vulnerability | 30 Nov 2023 | 21 Dec 2023 | Unknown |
| CVE-2023-6345 | Chromium Skia | Google Skia Integer Overflow Vulnerability | 30 Nov 2023 | 21 Dec 2023 | Unknown | |
| CVE-2023-4911 | GNU | GNU C Library | GNU C Library Buffer Overflow Vulnerability | 21 Nov 2023 | 12 Dec 2023 | Unknown |
| CVE-2020-2551 | Oracle | Fusion Middleware | Oracle Fusion Middleware Unspecified Vulnerability | 16 Nov 2023 | 7 Dec 2023 | Unknown |
| CVE-2023-1671 | Sophos | Web Appliance | Sophos Web Appliance Command Injection Vulnerability | 16 Nov 2023 | 7 Dec 2023 | Unknown |
| CVE-2023-36584 | Microsoft | Windows | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | 16 Nov 2023 | 7 Dec 2023 | Unknown |
| CVE-2023-36025 | Microsoft | Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | 14 Nov 2023 | 5 Dec 2023 | Unknown |
| CVE-2023-36033 | Microsoft | Windows | Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | 14 Nov 2023 | 5 Dec 2023 | Unknown |
| CVE-2023-36036 | Microsoft | Windows | Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability | 14 Nov 2023 | 5 Dec 2023 | Unknown |
| CVE-2023-36844 | Juniper | Junos OS | Juniper Junos OS EX Series PHP External Variable Modification Vulnerability | 13 Nov 2023 | 17 Nov 2023 | Unknown |
| CVE-2023-36845 | Juniper | Junos OS | Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability | 13 Nov 2023 | 17 Nov 2023 | Unknown |
| CVE-2023-36846 | Juniper | Junos OS | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | 13 Nov 2023 | 17 Nov 2023 | Unknown |
| CVE-2023-36847 | Juniper | Junos OS | Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability | 13 Nov 2023 | 17 Nov 2023 | Unknown |
| CVE-2023-36851 | Juniper | Junos OS | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | 13 Nov 2023 | 17 Nov 2023 | Unknown |
| CVE-2023-47246 | SysAid | SysAid Server | SysAid Server Path Traversal Vulnerability | 13 Nov 2023 | 4 Dec 2023 | Known |
| CVE-2023-29552 | IETF | Service Location Protocol (SLP) | Service Location Protocol (SLP) Denial-of-Service Vulnerability | 8 Nov 2023 | 29 Nov 2023 | Unknown |
| CVE-2023-22518 | Atlassian | Confluence Data Center and Server | Atlassian Confluence Data Center and Server Improper Authorization Vulnerability | 7 Nov 2023 | 28 Nov 2023 | Known |
| CVE-2023-46604 | Apache | ActiveMQ | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | 2 Nov 2023 | 23 Nov 2023 | Known |
| CVE-2023-46747 | F5 | BIG-IP Configuration Utility | F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability | 31 Oct 2023 | 21 Nov 2023 | Known |
| CVE-2023-46748 | F5 | BIG-IP Configuration Utility | F5 BIG-IP Configuration Utility SQL Injection Vulnerability | 31 Oct 2023 | 21 Nov 2023 | Unknown |
| CVE-2023-5631 | Roundcube | Webmail | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | 26 Oct 2023 | 16 Nov 2023 | Unknown |
| CVE-2023-20273 | Cisco | Cisco IOS XE Web UI | Cisco IOS XE Web UI Command Injection Vulnerability | 23 Oct 2023 | 27 Oct 2023 | Unknown |
| CVE-2023-4966 | Citrix | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | 18 Oct 2023 | 8 Nov 2023 | Known |
| CVE-2023-20198 | Cisco | IOS XE Web UI | Cisco IOS XE Web UI Privilege Escalation Vulnerability | 16 Oct 2023 | 20 Oct 2023 | Unknown |
| CVE-2023-20109 | Cisco | IOS and IOS XE | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability | 10 Oct 2023 | 31 Oct 2023 | Unknown |
| CVE-2023-21608 | Adobe | Acrobat and Reader | Adobe Acrobat and Reader Use-After-Free Vulnerability | 10 Oct 2023 | 31 Oct 2023 | Unknown |
| CVE-2023-36563 | Microsoft | WordPad | Microsoft WordPad Information Disclosure Vulnerability | 10 Oct 2023 | 31 Oct 2023 | Unknown |
| CVE-2023-41763 | Microsoft | Skype for Business | Microsoft Skype for Business Privilege Escalation Vulnerability | 10 Oct 2023 | 31 Oct 2023 | Unknown |
| CVE-2023-44487 | IETF | HTTP/2 | HTTP/2 Rapid Reset Attack Vulnerability | 10 Oct 2023 | 31 Oct 2023 | Unknown |
| CVE-2023-22515 | Atlassian | Confluence Data Center and Server | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability | 5 Oct 2023 | 13 Oct 2023 | Known |
| CVE-2023-40044 | Progress | WS_FTP Server | Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability | 5 Oct 2023 | 26 Oct 2023 | Known |
| CVE-2023-42824 | Apple | iOS and iPadOS | Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability | 5 Oct 2023 | 26 Oct 2023 | Unknown |
| CVE-2023-28229 | Microsoft | Windows CNG Key Isolation Service | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | 4 Oct 2023 | 25 Oct 2023 | Unknown |
| CVE-2023-42793 | JetBrains | TeamCity | JetBrains TeamCity Authentication Bypass Vulnerability | 4 Oct 2023 | 25 Oct 2023 | Known |
| CVE-2023-4211 | Arm | Mali GPU Kernel Driver | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | 3 Oct 2023 | 24 Oct 2023 | Unknown |
| CVE-2023-5217 | Chromium libvpx | Google Chromium libvpx Heap Buffer Overflow Vulnerability | 2 Oct 2023 | 23 Oct 2023 | Unknown | |
| CVE-2018-14667 | Red Hat | JBoss RichFaces Framework | Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability | 28 Sep 2023 | 19 Oct 2023 | Unknown |
| CVE-2023-41991 | Apple | Multiple Products | Apple Multiple Products Improper Certificate Validation Vulnerability | 25 Sep 2023 | 16 Oct 2023 | Unknown |
| CVE-2023-41992 | Apple | Multiple Products | Apple Multiple Products Kernel Privilege Escalation Vulnerability | 25 Sep 2023 | 16 Oct 2023 | Unknown |
| CVE-2023-41993 | Apple | Multiple Products | Apple Multiple Products WebKit Code Execution Vulnerability | 25 Sep 2023 | 16 Oct 2023 | Unknown |
| CVE-2023-41179 | Trend Micro | Apex One and Worry-Free Business Security | Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability | 21 Sep 2023 | 12 Oct 2023 | Unknown |
| CVE-2023-28434 | MinIO | MinIO | MinIO Security Feature Bypass Vulnerability | 19 Sep 2023 | 10 Oct 2023 | Unknown |
| CVE-2014-8361 | Realtek | SDK | Realtek SDK Improper Input Validation Vulnerability | 18 Sep 2023 | 9 Oct 2023 | Unknown |
| CVE-2017-6884 | Zyxel | EMG2926 Routers | Zyxel EMG2926 Routers Command Injection Vulnerability | 18 Sep 2023 | 9 Oct 2023 | Known |
| CVE-2021-3129 | Laravel | Ignition | Laravel Ignition File Upload Vulnerability | 18 Sep 2023 | 9 Oct 2023 | Known |
| CVE-2022-22265 | Samsung | Mobile Devices | Samsung Mobile Devices Use-After-Free Vulnerability | 18 Sep 2023 | 9 Oct 2023 | Unknown |
| CVE-2023-26369 | Adobe | Acrobat and Reader | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability | 14 Sep 2023 | 5 Oct 2023 | Unknown |
| CVE-2023-20269 | Cisco | Adaptive Security Appliance and Firepower Threat Defense | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | 13 Sep 2023 | 4 Oct 2023 | Known |
| CVE-2023-35674 | Android | Framework | Android Framework Privilege Escalation Vulnerability | 13 Sep 2023 | 4 Oct 2023 | Unknown |
| CVE-2023-4863 | Chromium WebP | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability | 13 Sep 2023 | 4 Oct 2023 | Unknown | |
| CVE-2023-36761 | Microsoft | Word | Microsoft Word Information Disclosure Vulnerability | 12 Sep 2023 | 3 Oct 2023 | Unknown |
| CVE-2023-36802 | Microsoft | Streaming Service Proxy | Microsoft Streaming Service Proxy Privilege Escalation Vulnerability | 12 Sep 2023 | 3 Oct 2023 | Unknown |
| CVE-2023-41061 | Apple | iOS, iPadOS, and watchOS | Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability | 11 Sep 2023 | 2 Oct 2023 | Unknown |
| CVE-2023-41064 | Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability | 11 Sep 2023 | 2 Oct 2023 | Unknown |
| CVE-2023-33246 | Apache | RocketMQ | Apache RocketMQ Command Execution Vulnerability | 6 Sep 2023 | 27 Sep 2023 | Unknown |
| CVE-2023-32315 | Ignite Realtime | Openfire | Ignite Realtime Openfire Path Traversal Vulnerability | 24 Aug 2023 | 14 Sep 2023 | Unknown |
| CVE-2023-38831 | RARLAB | WinRAR | RARLAB WinRAR Code Execution Vulnerability | 24 Aug 2023 | 14 Sep 2023 | Known |
| CVE-2023-27532 | Veeam | Backup & Replication | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | 22 Aug 2023 | 12 Sep 2023 | Known |
| CVE-2023-38035 | Ivanti | Sentry | Ivanti Sentry Authentication Bypass Vulnerability | 22 Aug 2023 | 12 Sep 2023 | Known |
| CVE-2023-26359 | Adobe | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | 21 Aug 2023 | 11 Sep 2023 | Unknown |
| CVE-2023-24489 | Citrix | Content Collaboration | Citrix Content Collaboration ShareFile Improper Access Control Vulnerability | 16 Aug 2023 | 6 Sep 2023 | Unknown |