Known Exploited Vulnerabilities
The CISA KEV catalog lists 1,779 CVEs with evidence of exploitation in the wild, newest first. Catalog version 2026.11.10. Source: sources and licenses.
| CVE | Vulnerability | Added | Federal due date | Ransomware |
|---|---|---|---|---|
| CVE-2024-21351 | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability Microsoft / Windows | Feb 13, 2024 | Mar 5, 2024 | |
| CVE-2024-21412 | Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability Microsoft / Windows | Feb 13, 2024 | Mar 5, 2024 | Known |
| CVE-2023-43770 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability Roundcube / Webmail | Feb 12, 2024 | Mar 4, 2024 | |
| CVE-2024-21762 | Fortinet FortiOS Out-of-Bound Write Vulnerability Fortinet / FortiOS | Feb 9, 2024 | Feb 16, 2024 | Known |
| CVE-2023-4762 | Google Chromium V8 Type Confusion Vulnerability Google / Chromium V8 | Feb 6, 2024 | Feb 27, 2024 | |
| CVE-2022-48618 | Apple Multiple Products Memory Corruption Vulnerability Apple / Multiple Products | Jan 31, 2024 | Feb 21, 2024 | |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability Ivanti / Connect Secure, Policy Secure, and Neurons | Jan 31, 2024 | Feb 2, 2024 | Known |
| CVE-2023-22527 | Atlassian Confluence Data Center and Server Template Injection Vulnerability Atlassian / Confluence Data Center and Server | Jan 24, 2024 | Feb 14, 2024 | Known |
| CVE-2024-23222 | Apple Multiple Products WebKit Type Confusion Vulnerability Apple / Multiple Products | Jan 23, 2024 | Feb 13, 2024 | |
| CVE-2023-34048 | VMware vCenter Server Out-of-Bounds Write Vulnerability VMware / vCenter Server | Jan 22, 2024 | Feb 12, 2024 | |
| CVE-2023-35082 | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability Ivanti / Endpoint Manager Mobile (EPMM) and MobileIron Core | Jan 18, 2024 | Feb 8, 2024 | Known |
| CVE-2023-6548 | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability Citrix / NetScaler ADC and NetScaler Gateway | Jan 17, 2024 | Jan 24, 2024 | |
| CVE-2023-6549 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability Citrix / NetScaler ADC and NetScaler Gateway | Jan 17, 2024 | Feb 7, 2024 | |
| CVE-2024-0519 | Google Chromium V8 Out-of-Bounds Memory Access Vulnerability Google / Chromium V8 | Jan 17, 2024 | Feb 7, 2024 | |
| CVE-2018-15133 | Laravel Deserialization of Untrusted Data Vulnerability Laravel / Laravel Framework | Jan 16, 2024 | Feb 6, 2024 | |
| CVE-2023-29357 | Microsoft SharePoint Server Privilege Escalation Vulnerability Microsoft / SharePoint Server | Jan 10, 2024 | Jan 31, 2024 | Known |
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability Ivanti / Connect Secure and Policy Secure | Jan 10, 2024 | Jan 22, 2024 | Known |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability Ivanti / Connect Secure and Policy Secure | Jan 10, 2024 | Jan 22, 2024 | Known |
| CVE-2016-20017 | D-Link DSL-2750B Devices Command Injection Vulnerability D-Link / DSL-2750B Devices | Jan 8, 2024 | Jan 29, 2024 | |
| CVE-2023-23752 | Joomla! Improper Access Control Vulnerability Joomla! / Joomla! | Jan 8, 2024 | Jan 29, 2024 | |
| CVE-2023-27524 | Apache Superset Insecure Default Initialization of Resource Vulnerability Apache / Superset | Jan 8, 2024 | Jan 29, 2024 | |
| CVE-2023-29300 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability Adobe / ColdFusion | Jan 8, 2024 | Jan 29, 2024 | Known |
| CVE-2023-38203 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability Adobe / ColdFusion | Jan 8, 2024 | Jan 29, 2024 | Known |
| CVE-2023-41990 | Apple Multiple Products Code Execution Vulnerability Apple / Multiple Products | Jan 8, 2024 | Jan 29, 2024 | |
| CVE-2023-7024 | Google Chromium WebRTC Heap Buffer Overflow Vulnerability Google / Chromium WebRTC | Jan 2, 2024 | Jan 23, 2024 | |
| CVE-2023-7101 | Spreadsheet::ParseExcel Remote Code Execution Vulnerability Spreadsheet::ParseExcel / Spreadsheet::ParseExcel | Jan 2, 2024 | Jan 23, 2024 | |
| CVE-2023-47565 | QNAP VioStor NVR OS Command Injection Vulnerability QNAP / VioStor NVR | Dec 21, 2023 | Jan 11, 2024 | |
| CVE-2023-49897 | FXC AE1021, AE1021PE OS Command Injection Vulnerability FXC / AE1021, AE1021PE | Dec 21, 2023 | Jan 11, 2024 | |
| CVE-2023-6448 | Unitronics Vision PLC and HMI Insecure Default Password Vulnerability Unitronics / Vision PLC and HMI | Dec 11, 2023 | Dec 18, 2023 | |
| CVE-2023-41265 | Qlik Sense HTTP Tunneling Vulnerability Qlik / Sense | Dec 7, 2023 | Dec 28, 2023 | Known |
| CVE-2023-41266 | Qlik Sense Path Traversal Vulnerability Qlik / Sense | Dec 7, 2023 | Dec 28, 2023 | Known |
| CVE-2022-22071 | Qualcomm Multiple Chipsets Use-After-Free Vulnerability Qualcomm / Multiple Chipsets | Dec 5, 2023 | Dec 26, 2023 | |
| CVE-2023-33063 | Qualcomm Multiple Chipsets Use-After-Free Vulnerability Qualcomm / Multiple Chipsets | Dec 5, 2023 | Dec 26, 2023 | |
| CVE-2023-33106 | Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability Qualcomm / Multiple Chipsets | Dec 5, 2023 | Dec 26, 2023 | |
| CVE-2023-33107 | Qualcomm Multiple Chipsets Integer Overflow Vulnerability Qualcomm / Multiple Chipsets | Dec 5, 2023 | Dec 26, 2023 | |
| CVE-2023-42916 | Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability Apple / Multiple Products | Dec 4, 2023 | Dec 25, 2023 | |
| CVE-2023-42917 | Apple Multiple Products WebKit Memory Corruption Vulnerability Apple / Multiple Products | Dec 4, 2023 | Dec 25, 2023 | |
| CVE-2023-49103 | ownCloud graphapi Information Disclosure Vulnerability ownCloud / ownCloud graphapi | Nov 30, 2023 | Dec 21, 2023 | |
| CVE-2023-6345 | Google Skia Integer Overflow Vulnerability Google / Chromium Skia | Nov 30, 2023 | Dec 21, 2023 | |
| CVE-2023-4911 | GNU C Library Buffer Overflow Vulnerability GNU / GNU C Library | Nov 21, 2023 | Dec 12, 2023 | |
| CVE-2020-2551 | Oracle Fusion Middleware Unspecified Vulnerability Oracle / Fusion Middleware | Nov 16, 2023 | Dec 7, 2023 | |
| CVE-2023-1671 | Sophos Web Appliance Command Injection Vulnerability Sophos / Web Appliance | Nov 16, 2023 | Dec 7, 2023 | |
| CVE-2023-36584 | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability Microsoft / Windows | Nov 16, 2023 | Dec 7, 2023 | |
| CVE-2023-36025 | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability Microsoft / Windows | Nov 14, 2023 | Dec 5, 2023 | |
| CVE-2023-36033 | Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability Microsoft / Windows | Nov 14, 2023 | Dec 5, 2023 | |
| CVE-2023-36036 | Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability Microsoft / Windows | Nov 14, 2023 | Dec 5, 2023 | |
| CVE-2023-36844 | Juniper Junos OS EX Series PHP External Variable Modification Vulnerability Juniper / Junos OS | Nov 13, 2023 | Nov 17, 2023 | |
| CVE-2023-36845 | Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability Juniper / Junos OS | Nov 13, 2023 | Nov 17, 2023 | |
| CVE-2023-36846 | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability Juniper / Junos OS | Nov 13, 2023 | Nov 17, 2023 | |
| CVE-2023-36847 | Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability Juniper / Junos OS | Nov 13, 2023 | Nov 17, 2023 | |
| CVE-2023-36851 | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability Juniper / Junos OS | Nov 13, 2023 | Nov 17, 2023 | |
| CVE-2023-47246 | SysAid Server Path Traversal Vulnerability SysAid / SysAid Server | Nov 13, 2023 | Dec 4, 2023 | Known |
| CVE-2023-29552 | Service Location Protocol (SLP) Denial-of-Service Vulnerability IETF / Service Location Protocol (SLP) | Nov 8, 2023 | Nov 29, 2023 | |
| CVE-2023-22518 | Atlassian Confluence Data Center and Server Improper Authorization Vulnerability Atlassian / Confluence Data Center and Server | Nov 7, 2023 | Nov 28, 2023 | Known |
| CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability Apache / ActiveMQ | Nov 2, 2023 | Nov 23, 2023 | Known |
| CVE-2023-46747 | F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability F5 / BIG-IP Configuration Utility | Oct 31, 2023 | Nov 21, 2023 | Known |
| CVE-2023-46748 | F5 BIG-IP Configuration Utility SQL Injection Vulnerability F5 / BIG-IP Configuration Utility | Oct 31, 2023 | Nov 21, 2023 | |
| CVE-2023-5631 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability Roundcube / Webmail | Oct 26, 2023 | Nov 16, 2023 | |
| CVE-2023-20273 | Cisco IOS XE Web UI Command Injection Vulnerability Cisco / Cisco IOS XE Web UI | Oct 23, 2023 | Oct 27, 2023 | |
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability Citrix / NetScaler ADC and NetScaler Gateway | Oct 18, 2023 | Nov 8, 2023 | Known |
| CVE-2023-20198 | Cisco IOS XE Web UI Privilege Escalation Vulnerability Cisco / IOS XE Web UI | Oct 16, 2023 | Oct 20, 2023 | |
| CVE-2023-20109 | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write Vulnerability Cisco / IOS and IOS XE | Oct 10, 2023 | Oct 31, 2023 | |
| CVE-2023-21608 | Adobe Acrobat and Reader Use-After-Free Vulnerability Adobe / Acrobat and Reader | Oct 10, 2023 | Oct 31, 2023 | |
| CVE-2023-36563 | Microsoft WordPad Information Disclosure Vulnerability Microsoft / WordPad | Oct 10, 2023 | Oct 31, 2023 | |
| CVE-2023-41763 | Microsoft Skype for Business Privilege Escalation Vulnerability Microsoft / Skype for Business | Oct 10, 2023 | Oct 31, 2023 | |
| CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability IETF / HTTP/2 | Oct 10, 2023 | Oct 31, 2023 | |
| CVE-2023-22515 | Atlassian Confluence Data Center and Server Broken Access Control Vulnerability Atlassian / Confluence Data Center and Server | Oct 5, 2023 | Oct 13, 2023 | Known |
| CVE-2023-40044 | Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability Progress / WS_FTP Server | Oct 5, 2023 | Oct 26, 2023 | Known |
| CVE-2023-42824 | Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability Apple / iOS and iPadOS | Oct 5, 2023 | Oct 26, 2023 | |
| CVE-2023-28229 | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability Microsoft / Windows CNG Key Isolation Service | Oct 4, 2023 | Oct 25, 2023 | |
| CVE-2023-42793 | JetBrains TeamCity Authentication Bypass Vulnerability JetBrains / TeamCity | Oct 4, 2023 | Oct 25, 2023 | Known |
| CVE-2023-4211 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability Arm / Mali GPU Kernel Driver | Oct 3, 2023 | Oct 24, 2023 | |
| CVE-2023-5217 | Google Chromium libvpx Heap Buffer Overflow Vulnerability Google / Chromium libvpx | Oct 2, 2023 | Oct 23, 2023 | |
| CVE-2018-14667 | Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability Red Hat / JBoss RichFaces Framework | Sep 28, 2023 | Oct 19, 2023 | |
| CVE-2023-41991 | Apple Multiple Products Improper Certificate Validation Vulnerability Apple / Multiple Products | Sep 25, 2023 | Oct 16, 2023 | |
| CVE-2023-41992 | Apple Multiple Products Kernel Privilege Escalation Vulnerability Apple / Multiple Products | Sep 25, 2023 | Oct 16, 2023 | |
| CVE-2023-41993 | Apple Multiple Products WebKit Code Execution Vulnerability Apple / Multiple Products | Sep 25, 2023 | Oct 16, 2023 | |
| CVE-2023-41179 | Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability Trend Micro / Apex One and Worry-Free Business Security | Sep 21, 2023 | Oct 12, 2023 | |
| CVE-2023-28434 | MinIO Security Feature Bypass Vulnerability MinIO / MinIO | Sep 19, 2023 | Oct 10, 2023 | |
| CVE-2014-8361 | Realtek SDK Improper Input Validation Vulnerability Realtek / SDK | Sep 18, 2023 | Oct 9, 2023 | |
| CVE-2017-6884 | Zyxel EMG2926 Routers Command Injection Vulnerability Zyxel / EMG2926 Routers | Sep 18, 2023 | Oct 9, 2023 | Known |
| CVE-2021-3129 | Laravel Ignition File Upload Vulnerability Laravel / Ignition | Sep 18, 2023 | Oct 9, 2023 | Known |
| CVE-2022-22265 | Samsung Mobile Devices Use-After-Free Vulnerability Samsung / Mobile Devices | Sep 18, 2023 | Oct 9, 2023 | |
| CVE-2023-26369 | Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability Adobe / Acrobat and Reader | Sep 14, 2023 | Oct 5, 2023 | |
| CVE-2023-20269 | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability Cisco / Adaptive Security Appliance and Firepower Threat Defense | Sep 13, 2023 | Oct 4, 2023 | Known |
| CVE-2023-35674 | Android Framework Privilege Escalation Vulnerability Android / Framework | Sep 13, 2023 | Oct 4, 2023 | |
| CVE-2023-4863 | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability Google / Chromium WebP | Sep 13, 2023 | Oct 4, 2023 | |
| CVE-2023-36761 | Microsoft Word Information Disclosure Vulnerability Microsoft / Word | Sep 12, 2023 | Oct 3, 2023 | |
| CVE-2023-36802 | Microsoft Streaming Service Proxy Privilege Escalation Vulnerability Microsoft / Streaming Service Proxy | Sep 12, 2023 | Oct 3, 2023 | |
| CVE-2023-41061 | Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability Apple / iOS, iPadOS, and watchOS | Sep 11, 2023 | Oct 2, 2023 | |
| CVE-2023-41064 | Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability Apple / iOS, iPadOS, and macOS | Sep 11, 2023 | Oct 2, 2023 | |
| CVE-2023-33246 | Apache RocketMQ Command Execution Vulnerability Apache / RocketMQ | Sep 6, 2023 | Sep 27, 2023 | |
| CVE-2023-32315 | Ignite Realtime Openfire Path Traversal Vulnerability Ignite Realtime / Openfire | Aug 24, 2023 | Sep 14, 2023 | |
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability RARLAB / WinRAR | Aug 24, 2023 | Sep 14, 2023 | Known |
| CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability Veeam / Backup & Replication | Aug 22, 2023 | Sep 12, 2023 | Known |
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability Ivanti / Sentry | Aug 22, 2023 | Sep 12, 2023 | Known |
| CVE-2023-26359 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability Adobe / ColdFusion | Aug 21, 2023 | Sep 11, 2023 | |
| CVE-2023-24489 | Citrix Content Collaboration ShareFile Improper Access Control Vulnerability Citrix / Content Collaboration | Aug 16, 2023 | Sep 6, 2023 | |
| CVE-2023-38180 | Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability Microsoft / .NET Core and Visual Studio | Aug 9, 2023 | Aug 30, 2023 | |
| CVE-2017-18368 | Zyxel P660HN-T1A Routers Command Injection Vulnerability Zyxel / P660HN-T1A Routers | Aug 7, 2023 | Aug 28, 2023 |
Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Sources and licenses