Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 8.8 High severity | Microsoft COM for Windows Deserialization of Untrusted Data CVE-2018-0824 | Aug 5, 2024 | Aug 26, 2024 | Not reported |
| 7.2 High severity | VMware ESXi Authentication Bypass CVE-2024-37085 | Jul 30, 2024 | Aug 20, 2024 | Known |
| 9.8 Critical severity | ServiceNow Incomplete List of Disallowed Inputs CVE-2024-5217 | Jul 29, 2024 | Aug 19, 2024 | Not reported |
| 9.8 Critical severity | ServiceNow Improper Input Validation CVE-2024-4879 | Jul 29, 2024 | Aug 19, 2024 | Not reported |
| 9.8 Critical severity | Acronis Cyber Infrastructure (ACI) Insecure Default Password CVE-2023-45249 | Jul 29, 2024 | Aug 19, 2024 | Not reported |
| 5.3 Medium severity | Twilio Authy Information Disclosure CVE-2024-39891 | Jul 23, 2024 | Aug 13, 2024 | Not reported |
| 8.8 High severity | Microsoft Internet Explorer Use-After-Free CVE-2012-4792 | Jul 23, 2024 | Aug 13, 2024 | Not reported |
| 9.8 Critical severity | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) CVE-2024-34102 | Jul 17, 2024 | Aug 7, 2024 | Not reported |
| 7.5 High severity | SolarWinds Serv-U Path Traversal CVE-2024-28995 | Jul 17, 2024 | Aug 7, 2024 | Not reported |
| 6.5 Medium severity | VMware vCenter Server Incorrect Default File Permissions CVE-2022-22948 | Jul 17, 2024 | Aug 7, 2024 | Not reported |
| 9.8 Critical severity | OSGeo GeoServer GeoTools Eval Injection CVE-2024-36401 | Jul 15, 2024 | Aug 5, 2024 | Not reported |
| 7.5 High severity | Microsoft Windows MSHTML Platform Spoofing CVE-2024-38112 | Jul 9, 2024 | Jul 30, 2024 | Not reported |
| 7.8 High severity | Microsoft Windows Hyper-V Privilege Escalation CVE-2024-38080 | Jul 9, 2024 | Jul 30, 2024 | Not reported |
| 9.8 Critical severity | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine CVE-2024-23692 | Jul 9, 2024 | Jul 30, 2024 | Known |
| 6.7 Medium severity | Cisco NX-OS Command Injection CVE-2024-20399 | Jul 2, 2024 | Jul 23, 2024 | Not reported |
| 7.8 High severity | Linux Kernel Use-After-Free CVE-2022-2586 | Jun 26, 2024 | Jul 17, 2024 | Not reported |
| 10.0 Critical severity | OSGeo GeoServer JAI-EXT Code Injection CVE-2022-24816 | Jun 26, 2024 | Jul 17, 2024 | Not reported |
| 6.1 Medium severity | Roundcube Webmail Cross-Site Scripting (XSS) CVE-2020-13965 | Jun 26, 2024 | Jul 17, 2024 | Not reported |
| 9.8 Critical severity | Progress Telerik Report Server Authentication Bypass by Spoofing CVE-2024-4358 | Jun 13, 2024 | Jul 4, 2024 | Not reported |
| 7.8 High severity | Android Pixel Privilege Escalation CVE-2024-32896 | Jun 13, 2024 | Jul 4, 2024 | Not reported |
| 7.8 High severity | Microsoft Windows Error Reporting Service Improper Privilege Management CVE-2024-26169 | Jun 13, 2024 | Jul 4, 2024 | Known |
| 7.8 High severity | Arm Mali GPU Kernel Driver Use-After-Free CVE-2024-4610 | Jun 12, 2024 | Jul 3, 2024 | Not reported |
| 9.8 Critical severity | PHP-CGI OS Command Injection CVE-2024-4577 | Jun 12, 2024 | Jul 3, 2024 | Known |
| 7.4 High severity | Oracle WebLogic Server OS Command Injection CVE-2017-3506 | Jun 3, 2024 | Jun 24, 2024 | Not reported |
| 8.6 High severity | Check Point Quantum Security Gateways Information Disclosure CVE-2024-24919 | May 30, 2024 | Jun 20, 2024 | Known |
| 7.8 High severity | Linux Kernel Use-After-Free CVE-2024-1086 | May 30, 2024 | Jun 20, 2024 | Known |
| 8.4 High severity | Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code CVE-2024-4978 | May 29, 2024 | Jun 19, 2024 | Not reported |
| 9.6 Critical severity | Google Chromium V8 Type Confusion CVE-2024-5274 | May 28, 2024 | Jun 18, 2024 | Not reported |
| 7.5 High severity | Apache Flink Improper Access Control CVE-2020-17519 | May 23, 2024 | Jun 13, 2024 | Not reported |
| 9.6 Critical severity | Google Chromium V8 Type Confusion CVE-2024-4947 | May 20, 2024 | Jun 10, 2024 | Not reported |
| 9.8 Critical severity | NextGen Healthcare Mirth Connect Deserialization of Untrusted Data CVE-2023-43208 | May 20, 2024 | Jun 10, 2024 | Known |
| 8.8 High severity | Google Chromium V8 Out-of-Bounds Memory Write CVE-2024-4761 | May 16, 2024 | Jun 6, 2024 | Not reported |
| 7.5 High severity | D-Link DIR-605 Router Information Disclosure CVE-2021-40655 | May 16, 2024 | Jun 6, 2024 | Not reported |
| 8.0 High severity | D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) CVE-2014-100005 | May 16, 2024 | Jun 6, 2024 | Not reported |
| 7.8 High severity | Microsoft DWM Core Library Privilege Escalation CVE-2024-30051 | May 14, 2024 | Jun 4, 2024 | Known |
| 8.8 High severity | Microsoft Windows MSHTML Platform Security Feature Bypass CVE-2024-30040 | May 14, 2024 | Jun 4, 2024 | Not reported |
| 9.6 Critical severity | Google Chromium Visuals Use-After-Free CVE-2024-4671 | May 13, 2024 | Jun 3, 2024 | Not reported |
| 9.8 Critical severity | GitLab Community and Enterprise Editions Improper Access Control CVE-2023-7028 | May 1, 2024 | May 22, 2024 | Not reported |
| 8.8 High severity | Microsoft SmartScreen Prompt Security Feature Bypass CVE-2024-29988 | Apr 30, 2024 | May 21, 2024 | Not reported |
| 10.0 Critical severity | CrushFTP VFS Sandbox Escape CVE-2024-4040 | Apr 24, 2024 | May 1, 2024 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.