Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 9.8 Critical severity | Ivanti Virtual Traffic Manager Authentication Bypass CVE-2024-7593 | Sep 24, 2024 | Oct 15, 2024 | Not reported |
| 9.1 Critical severity | Ivanti Cloud Services Appliance (CSA) Path Traversal CVE-2024-8963 | Sep 19, 2024 | Oct 10, 2024 | Not reported |
| 9.8 Critical severity | Apache HugeGraph-Server Improper Access Control CVE-2024-27348 | Sep 18, 2024 | Oct 9, 2024 | Not reported |
| 7.5 High severity | Oracle ADF Faces Deserialization of Untrusted Data CVE-2022-21445 | Sep 18, 2024 | Oct 9, 2024 | Not reported |
| 9.8 Critical severity | Oracle WebLogic Server Remote Code Execution CVE-2020-14644 | Sep 18, 2024 | Oct 9, 2024 | Not reported |
| 8.8 High severity | Microsoft SQL Server Reporting Services Remote Code Execution CVE-2020-0618 | Sep 18, 2024 | Oct 9, 2024 | Known |
| 8.8 High severity | Adobe Flash Player Double Free Vulnerablity CVE-2014-0502 | Sep 17, 2024 | Oct 8, 2024 | Not reported |
| 9.8 Critical severity | Adobe Flash Player Integer Underflow Vulnerablity CVE-2014-0497 | Sep 17, 2024 | Oct 8, 2024 | Not reported |
| 8.8 High severity | Adobe Flash Player Code Execution CVE-2013-0648 | Sep 17, 2024 | Oct 8, 2024 | Not reported |
| 8.8 High severity | Adobe Flash Player Incorrect Default Permissions CVE-2013-0643 | Sep 17, 2024 | Oct 8, 2024 | Not reported |
| 9.8 Critical severity | Progress WhatsUp Gold SQL Injection CVE-2024-6670 | Sep 16, 2024 | Oct 7, 2024 | Known |
| 8.8 High severity | Microsoft Windows MSHTML Platform Spoofing CVE-2024-43461 | Sep 16, 2024 | Oct 7, 2024 | Not reported |
| 7.2 High severity | Ivanti Cloud Services Appliance OS Command Injection CVE-2024-8190 | Sep 13, 2024 | Oct 4, 2024 | Not reported |
| 7.3 High severity | Microsoft Publisher Protection Mechanism Failure CVE-2024-38226 | Sep 10, 2024 | Oct 1, 2024 | Not reported |
| 5.4 Medium severity | Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure CVE-2024-38217 | Sep 10, 2024 | Oct 1, 2024 | Not reported |
| 7.8 High severity | Microsoft Windows Installer Improper Privilege Management CVE-2024-38014 | Sep 10, 2024 | Oct 1, 2024 | Not reported |
| 9.8 Critical severity | SonicWall SonicOS Improper Access Control CVE-2024-40766 | Sep 9, 2024 | Sep 30, 2024 | Known |
| 7.8 High severity | Linux Kernel PIE Stack Buffer Corruption CVE-2017-1000253 | Sep 9, 2024 | Sep 30, 2024 | Known |
| 8.4 High severity | ImageMagick Improper Input Validation CVE-2016-3714 | Sep 9, 2024 | Sep 30, 2024 | Not reported |
| 7.8 High severity | Kingsoft WPS Office Path Traversal CVE-2024-7262 | Sep 3, 2024 | Sep 24, 2024 | Not reported |
| 7.5 High severity | Draytek VigorConnect Path Traversal CVE-2021-20124 | Sep 3, 2024 | Sep 24, 2024 | Not reported |
| 7.5 High severity | Draytek VigorConnect Path Traversal CVE-2021-20123 | Sep 3, 2024 | Sep 24, 2024 | Not reported |
| 8.8 High severity | Google Chromium V8 Inappropriate Implementation CVE-2024-7965 | Aug 28, 2024 | Sep 18, 2024 | Not reported |
| 9.8 Critical severity | Apache OFBiz Incorrect Authorization CVE-2024-38856 | Aug 27, 2024 | Sep 17, 2024 | Not reported |
| 9.6 Critical severity | Google Chromium V8 Type Confusion CVE-2024-7971 | Aug 26, 2024 | Sep 16, 2024 | Not reported |
| 7.2 High severity | Versa Director Dangerous File Type Upload CVE-2024-39717 | Aug 23, 2024 | Sep 13, 2024 | Not reported |
| 8.4 High severity | Linux Kernel Heap-Based Buffer Overflow CVE-2022-0185 | Aug 21, 2024 | Sep 11, 2024 | Not reported |
| 9.8 Critical severity | Dahua IP Camera Authentication Bypass CVE-2021-33045 | Aug 21, 2024 | Sep 11, 2024 | Not reported |
| 9.8 Critical severity | Dahua IP Camera Authentication Bypass CVE-2021-33044 | Aug 21, 2024 | Sep 11, 2024 | Not reported |
| 7.2 High severity | Microsoft Exchange Server Information Disclosure CVE-2021-31196 | Aug 21, 2024 | Sep 11, 2024 | Not reported |
| 9.8 Critical severity | Jenkins Command Line Interface (CLI) Path Traversal CVE-2024-23897 | Aug 19, 2024 | Sep 9, 2024 | Known |
| 9.8 Critical severity | SolarWinds Web Help Desk Deserialization of Untrusted Data CVE-2024-28986 | Aug 15, 2024 | Sep 5, 2024 | Not reported |
| 6.5 Medium severity | Microsoft Windows SmartScreen Security Feature Bypass CVE-2024-38213 | Aug 13, 2024 | Sep 3, 2024 | Not reported |
| 7.8 High severity | Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation CVE-2024-38193 | Aug 13, 2024 | Sep 3, 2024 | Not reported |
| 8.8 High severity | Microsoft Project Remote Code Execution CVE-2024-38189 | Aug 13, 2024 | Sep 3, 2024 | Not reported |
| 7.5 High severity | Microsoft Windows Scripting Engine Memory Corruption CVE-2024-38178 | Aug 13, 2024 | Sep 3, 2024 | Not reported |
| 7.8 High severity | Microsoft Windows Power Dependency Coordinator Privilege Escalation CVE-2024-38107 | Aug 13, 2024 | Sep 3, 2024 | Not reported |
| 7.0 High severity | Microsoft Windows Kernel Privilege Escalation CVE-2024-38106 | Aug 13, 2024 | Sep 3, 2024 | Not reported |
| 7.8 High severity | Android Kernel Remote Code Execution CVE-2024-36971 | Aug 7, 2024 | Aug 28, 2024 | Not reported |
| 9.8 Critical severity | Apache OFBiz Path Traversal CVE-2024-32113 | Aug 7, 2024 | Aug 28, 2024 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.