Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 8.8 High severity | Apple Multiple Products Code Execution CVE-2024-44308 | Nov 21, 2024 | Dec 12, 2024 | Not reported |
| 7.5 High severity | Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization CVE-2024-21287 | Nov 21, 2024 | Dec 12, 2024 | Not reported |
| 9.8 Critical severity | VMware vCenter Server Privilege Escalation CVE-2024-38813 | Nov 20, 2024 | Dec 11, 2024 | Not reported |
| 9.8 Critical severity | VMware vCenter Server Heap-Based Buffer Overflow CVE-2024-38812 | Nov 20, 2024 | Dec 11, 2024 | Not reported |
| 7.2 High severity | Palo Alto Networks PAN-OS Management Interface OS Command Injection CVE-2024-9474 | Nov 18, 2024 | Dec 9, 2024 | Known |
| 9.8 Critical severity | Progress Kemp LoadMaster OS Command Injection CVE-2024-1212 | Nov 18, 2024 | Dec 9, 2024 | Not reported |
| 9.8 Critical severity | Palo Alto Networks PAN-OS Management Interface Authentication Bypass CVE-2024-0012 | Nov 18, 2024 | Dec 9, 2024 | Known |
| 9.1 Critical severity | Palo Alto Networks Expedition SQL Injection CVE-2024-9465 | Nov 14, 2024 | Dec 5, 2024 | Not reported |
| 7.5 High severity | Palo Alto Networks Expedition OS Command Injection CVE-2024-9463 | Nov 14, 2024 | Dec 5, 2024 | Not reported |
| 8.8 High severity | Microsoft Windows Task Scheduler Privilege Escalation CVE-2024-49039 | Nov 12, 2024 | Dec 3, 2024 | Known |
| 6.5 Medium severity | Microsoft Windows NTLMv2 Hash Disclosure Spoofing CVE-2024-43451 | Nov 12, 2024 | Dec 3, 2024 | Not reported |
| 7.5 High severity | Metabase GeoJSON API Local File Inclusion CVE-2021-41277 | Nov 12, 2024 | Dec 3, 2024 | Not reported |
| 5.3 Medium severity | Atlassian Jira Server and Data Center Path Traversal CVE-2021-26086 | Nov 12, 2024 | Dec 3, 2024 | Not reported |
| 6.1 Medium severity | Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) CVE-2014-2120 | Nov 12, 2024 | Dec 3, 2024 | Not reported |
| 9.8 Critical severity | Palo Alto Networks Expedition Missing Authentication CVE-2024-5910 | Nov 7, 2024 | Nov 28, 2024 | Not reported |
| 9.8 Critical severity | CyberPanel Incorrect Default Permissions CVE-2024-51567 | Nov 7, 2024 | Nov 28, 2024 | Known |
| 7.3 High severity | Android Framework Privilege Escalation CVE-2024-43093 | Nov 7, 2024 | Nov 28, 2024 | Not reported |
| 9.8 Critical severity | Nostromo nhttpd Directory Traversal CVE-2019-16278 | Nov 7, 2024 | Nov 28, 2024 | Not reported |
| 7.2 High severity | PTZOptics PT30X-SDI/NDI Cameras OS Command Injection CVE-2024-8957 | Nov 4, 2024 | Nov 25, 2024 | Not reported |
| 9.1 Critical severity | PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass CVE-2024-8956 | Nov 4, 2024 | Nov 25, 2024 | Not reported |
| 6.1 Medium severity | RoundCube Webmail Cross-Site Scripting (XSS) CVE-2024-37383 | Oct 24, 2024 | Nov 14, 2024 | Not reported |
| 5.8 Medium severity | Cisco ASA and FTD Denial-of-Service CVE-2024-20481 | Oct 24, 2024 | Nov 14, 2024 | Not reported |
| 9.8 Critical severity | Fortinet FortiManager Missing Authentication CVE-2024-47575 | Oct 23, 2024 | Nov 13, 2024 | Not reported |
| 7.2 High severity | Microsoft SharePoint Deserialization CVE-2024-38094 | Oct 22, 2024 | Nov 12, 2024 | Known |
| 9.8 Critical severity | ScienceLogic SL1 Unspecified CVE-2024-9537 | Oct 21, 2024 | Nov 11, 2024 | Not reported |
| 9.8 Critical severity | Veeam Backup and Replication Deserialization CVE-2024-40711 | Oct 17, 2024 | Nov 7, 2024 | Known |
| 9.8 Critical severity | Mozilla Firefox Use-After-Free CVE-2024-9680 | Oct 15, 2024 | Nov 5, 2024 | Known |
| 7.0 High severity | Microsoft Windows Kernel TOCTOU Race Condition CVE-2024-30088 | Oct 15, 2024 | Nov 5, 2024 | Known |
| 9.1 Critical severity | SolarWinds Web Help Desk Hardcoded Credential CVE-2024-28987 | Oct 15, 2024 | Nov 5, 2024 | Not reported |
| 7.2 High severity | Ivanti Cloud Services Appliance (CSA) OS Command Injection CVE-2024-9380 | Oct 9, 2024 | Oct 30, 2024 | Not reported |
| 7.2 High severity | Ivanti Cloud Services Appliance (CSA) SQL Injection CVE-2024-9379 | Oct 9, 2024 | Oct 30, 2024 | Not reported |
| 9.8 Critical severity | Fortinet Multiple Products Format String CVE-2024-23113 | Oct 9, 2024 | Oct 30, 2024 | Not reported |
| 8.1 High severity | Microsoft Windows MSHTML Platform Spoofing CVE-2024-43573 | Oct 8, 2024 | Oct 29, 2024 | Not reported |
| 7.8 High severity | Microsoft Windows Management Console Remote Code Execution CVE-2024-43572 | Oct 8, 2024 | Oct 29, 2024 | Not reported |
| 7.8 High severity | Qualcomm Multiple Chipsets Use-After-Free CVE-2024-43047 | Oct 8, 2024 | Oct 29, 2024 | Not reported |
| 9.8 Critical severity | Synacor Zimbra Collaboration Suite (ZCS) Command Execution CVE-2024-45519 | Oct 3, 2024 | Oct 24, 2024 | Not reported |
| 8.8 High severity | Ivanti Endpoint Manager (EPM) SQL Injection CVE-2024-29824 | Oct 2, 2024 | Oct 23, 2024 | Not reported |
| 9.8 Critical severity | D-Link DIR-820 Router OS Command Injection CVE-2023-25280 | Sep 30, 2024 | Oct 21, 2024 | Not reported |
| 9.8 Critical severity | DrayTek Multiple Vigor Routers OS Command Injection CVE-2020-15415 | Sep 30, 2024 | Oct 21, 2024 | Not reported |
| 9.8 Critical severity | SAP Commerce Cloud Deserialization of Untrusted Data CVE-2019-0344 | Sep 30, 2024 | Oct 21, 2024 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.