Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 6.0 Medium severity | Cisco ASA and FTD Privilege Escalation CVE-2024-20359 | Apr 24, 2024 | May 1, 2024 | Not reported |
| 8.6 High severity | Cisco ASA and FTD Denial of Service CVE-2024-20353 | Apr 24, 2024 | May 1, 2024 | Not reported |
| 7.8 High severity | Microsoft Windows Print Spooler Privilege Escalation CVE-2022-38028 | Apr 23, 2024 | May 14, 2024 | Not reported |
| 10.0 Critical severity | Palo Alto Networks PAN-OS Command Injection CVE-2024-3400 | Apr 12, 2024 | Apr 19, 2024 | Known |
| 9.8 Critical severity | D-Link Multiple NAS Devices Command Injection CVE-2024-3273 | Apr 11, 2024 | May 2, 2024 | Not reported |
| 9.8 Critical severity | D-Link Multiple NAS Devices Use of Hard-Coded Credentials CVE-2024-3272 | Apr 11, 2024 | May 2, 2024 | Not reported |
| 7.8 High severity | Android Pixel Privilege Escalation CVE-2024-29748 | Apr 4, 2024 | Apr 25, 2024 | Not reported |
| 5.5 Medium severity | Android Pixel Information Disclosure CVE-2024-29745 | Apr 4, 2024 | Apr 25, 2024 | Not reported |
| 7.2 High severity | Microsoft SharePoint Server Code Injection CVE-2023-24955 | Mar 26, 2024 | Apr 16, 2024 | Known |
| 9.8 Critical severity | Fortinet FortiClient EMS SQL Injection CVE-2023-48788 | Mar 25, 2024 | Apr 15, 2024 | Known |
| 9.8 Critical severity | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection CVE-2021-44529 | Mar 25, 2024 | Apr 15, 2024 | Known |
| 9.8 Critical severity | Nice Linear eMerge E3-Series OS Command Injection CVE-2019-7256 | Mar 25, 2024 | Apr 15, 2024 | Not reported |
| 9.8 Critical severity | JetBrains TeamCity Authentication Bypass CVE-2024-27198 | Mar 7, 2024 | Mar 28, 2024 | Known |
| 7.8 High severity | Apple Multiple Products Memory Corruption CVE-2024-23296 | Mar 6, 2024 | Mar 27, 2024 | Not reported |
| 7.8 High severity | Apple Multiple Products Memory Corruption CVE-2024-23225 | Mar 6, 2024 | Mar 27, 2024 | Not reported |
| 5.5 Medium severity | Android Pixel Information Disclosure CVE-2023-21237 | Mar 5, 2024 | Mar 26, 2024 | Not reported |
| 9.8 Critical severity | Sunhillo SureLine OS Command Injection Vulnerablity CVE-2021-36380 | Mar 5, 2024 | Mar 26, 2024 | Not reported |
| 7.8 High severity | Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control CVE-2024-21338 | Mar 4, 2024 | Mar 25, 2024 | Known |
| 8.4 High severity | Microsoft Streaming Service Untrusted Pointer Dereference CVE-2023-29360 | Feb 29, 2024 | Mar 21, 2024 | Not reported |
| 10.0 Critical severity | ConnectWise ScreenConnect Authentication Bypass CVE-2024-1709 | Feb 22, 2024 | Feb 29, 2024 | Known |
| 9.8 Critical severity | Microsoft Exchange Server Privilege Escalation CVE-2024-21410 | Feb 15, 2024 | Mar 7, 2024 | Not reported |
| 7.5 High severity | Cisco ASA and FTD Information Disclosure CVE-2020-3259 | Feb 15, 2024 | Mar 7, 2024 | Known |
| 8.1 High severity | Microsoft Windows Internet Shortcut Files Security Feature Bypass CVE-2024-21412 | Feb 13, 2024 | Mar 5, 2024 | Known |
| 7.6 High severity | Microsoft Windows SmartScreen Security Feature Bypass CVE-2024-21351 | Feb 13, 2024 | Mar 5, 2024 | Not reported |
| 6.1 Medium severity | Roundcube Webmail Persistent Cross-Site Scripting (XSS) CVE-2023-43770 | Feb 12, 2024 | Mar 4, 2024 | Not reported |
| 9.8 Critical severity | Fortinet FortiOS Out-of-Bound Write CVE-2024-21762 | Feb 9, 2024 | Feb 16, 2024 | Known |
| 8.8 High severity | Google Chromium V8 Type Confusion CVE-2023-4762 | Feb 6, 2024 | Feb 27, 2024 | Not reported |
| 8.2 High severity | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) CVE-2024-21893 | Jan 31, 2024 | Feb 2, 2024 | Known |
| 7.0 High severity | Apple Multiple Products Memory Corruption CVE-2022-48618 | Jan 31, 2024 | Feb 21, 2024 | Not reported |
| 9.8 Critical severity | Atlassian Confluence Data Center and Server Template Injection CVE-2023-22527 | Jan 24, 2024 | Feb 14, 2024 | Known |
| 8.8 High severity | Apple Multiple Products WebKit Type Confusion CVE-2024-23222 | Jan 23, 2024 | Feb 13, 2024 | Not reported |
| 9.8 Critical severity | VMware vCenter Server Out-of-Bounds Write CVE-2023-34048 | Jan 22, 2024 | Feb 12, 2024 | Not reported |
| 9.8 Critical severity | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass CVE-2023-35082 | Jan 18, 2024 | Feb 8, 2024 | Known |
| 8.8 High severity | Google Chromium V8 Out-of-Bounds Memory Access CVE-2024-0519 | Jan 17, 2024 | Feb 7, 2024 | Not reported |
| 7.5 High severity | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow CVE-2023-6549 | Jan 17, 2024 | Feb 7, 2024 | Not reported |
| 8.8 High severity | Citrix NetScaler ADC and NetScaler Gateway Code Injection CVE-2023-6548 | Jan 17, 2024 | Jan 24, 2024 | Not reported |
| 8.1 High severity | Laravel Deserialization of Untrusted Data CVE-2018-15133 | Jan 16, 2024 | Feb 6, 2024 | Not reported |
| 9.1 Critical severity | Ivanti Connect Secure and Policy Secure Command Injection CVE-2024-21887 | Jan 10, 2024 | Jan 22, 2024 | Known |
| 8.2 High severity | Ivanti Connect Secure and Policy Secure Authentication Bypass CVE-2023-46805 | Jan 10, 2024 | Jan 22, 2024 | Known |
| 9.8 Critical severity | Microsoft SharePoint Server Privilege Escalation CVE-2023-29357 | Jan 10, 2024 | Jan 31, 2024 | Known |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.