Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.8 High severity | Dante Discovery Process Control CVE-2022-23748 | Feb 6, 2025 | Feb 27, 2025 | Not reported |
| 9.8 Critical severity | CyberoamOS (CROS) SQL Injection CVE-2020-29574 | Feb 6, 2025 | Feb 27, 2025 | Known |
| 9.8 Critical severity | Sophos XG Firewall Buffer Overflow CVE-2020-15069 | Feb 6, 2025 | Feb 27, 2025 | Not reported |
| 7.8 High severity | Linux Kernel Out-of-Bounds Write CVE-2024-53104 | Feb 5, 2025 | Feb 26, 2025 | Not reported |
| 7.5 High severity | Apache OFBiz Forced Browsing CVE-2024-45195 | Feb 4, 2025 | Feb 25, 2025 | Not reported |
| 7.5 High severity | Microsoft .NET Framework Information Disclosure CVE-2024-29059 | Feb 4, 2025 | Feb 25, 2025 | Not reported |
| 7.2 High severity | Paessler PRTG Network Monitor OS Command Injection CVE-2018-9276 | Feb 4, 2025 | Feb 25, 2025 | Not reported |
| 9.8 Critical severity | Paessler PRTG Network Monitor Local File Inclusion CVE-2018-19410 | Feb 4, 2025 | Feb 25, 2025 | Not reported |
| 10.0 Critical severity | Apple Multiple Products Use-After-Free CVE-2025-24085 | Jan 29, 2025 | Feb 19, 2025 | Not reported |
| 9.8 Critical severity | SonicWall SMA1000 Appliances Deserialization CVE-2025-23006 | Jan 24, 2025 | Feb 14, 2025 | Known |
| 6.1 Medium severity | JQuery Cross-Site Scripting (XSS) CVE-2020-11023 | Jan 23, 2025 | Feb 13, 2025 | Not reported |
| 9.8 Critical severity | Aviatrix Controllers OS Command Injection CVE-2024-50603 | Jan 16, 2025 | Feb 6, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free CVE-2025-21335 | Jan 14, 2025 | Feb 4, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free CVE-2025-21334 | Jan 14, 2025 | Feb 4, 2025 | Not reported |
| 7.8 High severity | Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow CVE-2025-21333 | Jan 14, 2025 | Feb 4, 2025 | Not reported |
| 9.8 Critical severity | Fortinet FortiOS and FortiProxy Authentication Bypass CVE-2024-55591 | Jan 14, 2025 | Jan 21, 2025 | Known |
| 7.2 High severity | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection CVE-2024-12686 | Jan 13, 2025 | Feb 3, 2025 | Not reported |
| 9.9 Critical severity | Qlik Sense HTTP Tunneling CVE-2023-48365 | Jan 13, 2025 | Feb 3, 2025 | Known |
| 9.0 Critical severity | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow CVE-2025-0282 | Jan 8, 2025 | Jan 15, 2025 | Known |
| 2.7 Low severity | Mitel MiCollab Path Traversal CVE-2024-55550 | Jan 7, 2025 | Jan 28, 2025 | Known |
| 9.1 Critical severity | Mitel MiCollab Path Traversal CVE-2024-41713 | Jan 7, 2025 | Jan 28, 2025 | Known |
| 9.8 Critical severity | Oracle WebLogic Server Unspecified CVE-2020-2883 | Jan 7, 2025 | Jan 28, 2025 | Not reported |
| 7.5 High severity | Palo Alto Networks PAN-OS Malicious DNS Packet CVE-2024-3393 | Dec 30, 2024 | Jan 20, 2025 | Not reported |
| 8.1 High severity | Acclaim Systems USAHERDS Use of Hard-Coded Credentials CVE-2021-44207 | Dec 23, 2024 | Jan 13, 2025 | Not reported |
| 9.8 Critical severity | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection CVE-2024-12356 | Dec 19, 2024 | Dec 27, 2024 | Not reported |
| 9.8 Critical severity | NUUO NVRmini2 Devices Missing Authentication CVE-2022-23227 | Dec 18, 2024 | Jan 8, 2025 | Not reported |
| 7.2 High severity | Reolink RLC-410W IP Camera OS Command Injection CVE-2021-40407 | Dec 18, 2024 | Jan 8, 2025 | Not reported |
| 7.2 High severity | Reolink Multiple IP Cameras OS Command Injection CVE-2019-11001 | Dec 18, 2024 | Jan 8, 2025 | Not reported |
| 9.8 Critical severity | NUUO NVRmini Devices OS Command Injection CVE-2018-14933 | Dec 18, 2024 | Jan 8, 2025 | Not reported |
| 9.8 Critical severity | Cleo Multiple Products Unauthenticated File Upload CVE-2024-55956 | Dec 17, 2024 | Jan 7, 2025 | Known |
| 7.8 High severity | Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference CVE-2024-35250 | Dec 16, 2024 | Jan 6, 2025 | Not reported |
| 7.4 High severity | Adobe ColdFusion Improper Access Control CVE-2024-20767 | Dec 16, 2024 | Jan 6, 2025 | Not reported |
| 9.8 Critical severity | Cleo Multiple Products Unrestricted File Upload CVE-2024-50623 | Dec 13, 2024 | Jan 3, 2025 | Known |
| 7.8 High severity | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow CVE-2024-49138 | Dec 10, 2024 | Dec 31, 2024 | Not reported |
| 9.8 Critical severity | CyberPanel Incorrect Default Permissions CVE-2024-51378 | Dec 4, 2024 | Dec 25, 2024 | Known |
| 9.8 Critical severity | ProjectSend Improper Authentication CVE-2024-11680 | Dec 3, 2024 | Dec 24, 2024 | Not reported |
| 9.8 Critical severity | Zyxel Multiple Firewalls Path Traversal CVE-2024-11667 | Dec 3, 2024 | Dec 24, 2024 | Known |
| 7.5 High severity | North Grid Proself Improper Restriction of XML External Entity (XXE) Reference CVE-2023-45727 | Dec 3, 2024 | Dec 24, 2024 | Not reported |
| 9.8 Critical severity | Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function CVE-2023-28461 | Nov 25, 2024 | Dec 16, 2024 | Known |
| 6.3 Medium severity | Apple Multiple Products Cross-Site Scripting (XSS) CVE-2024-44309 | Nov 21, 2024 | Dec 12, 2024 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.