Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.8 High severity | Apple Multiple Products Code Execution CVE-2023-41990 | Jan 8, 2024 | Jan 29, 2024 | Not reported |
| 9.8 Critical severity | Adobe ColdFusion Deserialization of Untrusted Data CVE-2023-38203 | Jan 8, 2024 | Jan 29, 2024 | Known |
| 9.8 Critical severity | Adobe ColdFusion Deserialization of Untrusted Data CVE-2023-29300 | Jan 8, 2024 | Jan 29, 2024 | Known |
| 9.8 Critical severity | Apache Superset Insecure Default Initialization of Resource CVE-2023-27524 | Jan 8, 2024 | Jan 29, 2024 | Not reported |
| 5.3 Medium severity | Joomla! Improper Access Control CVE-2023-23752 | Jan 8, 2024 | Jan 29, 2024 | Not reported |
| 9.8 Critical severity | D-Link DSL-2750B Devices Command Injection CVE-2016-20017 | Jan 8, 2024 | Jan 29, 2024 | Not reported |
| 7.8 High severity | Spreadsheet::ParseExcel Remote Code Execution CVE-2023-7101 | Jan 2, 2024 | Jan 23, 2024 | Not reported |
| 8.8 High severity | Google Chromium WebRTC Heap Buffer Overflow CVE-2023-7024 | Jan 2, 2024 | Jan 23, 2024 | Not reported |
| 8.8 High severity | FXC AE1021, AE1021PE OS Command Injection CVE-2023-49897 | Dec 21, 2023 | Jan 11, 2024 | Not reported |
| 8.8 High severity | QNAP VioStor NVR OS Command Injection CVE-2023-47565 | Dec 21, 2023 | Jan 11, 2024 | Not reported |
| 9.8 Critical severity | Unitronics Vision PLC and HMI Insecure Default Password CVE-2023-6448 | Dec 11, 2023 | Dec 18, 2023 | Not reported |
| 6.5 Medium severity | Qlik Sense Path Traversal CVE-2023-41266 | Dec 7, 2023 | Dec 28, 2023 | Known |
| 9.9 Critical severity | Qlik Sense HTTP Tunneling CVE-2023-41265 | Dec 7, 2023 | Dec 28, 2023 | Known |
| 7.8 High severity | Qualcomm Multiple Chipsets Integer Overflow CVE-2023-33107 | Dec 5, 2023 | Dec 26, 2023 | Not reported |
| 7.8 High severity | Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset CVE-2023-33106 | Dec 5, 2023 | Dec 26, 2023 | Not reported |
| 7.8 High severity | Qualcomm Multiple Chipsets Use-After-Free CVE-2023-33063 | Dec 5, 2023 | Dec 26, 2023 | Not reported |
| 7.8 High severity | Qualcomm Multiple Chipsets Use-After-Free CVE-2022-22071 | Dec 5, 2023 | Dec 26, 2023 | Not reported |
| 8.8 High severity | Apple Multiple Products WebKit Memory Corruption CVE-2023-42917 | Dec 4, 2023 | Dec 25, 2023 | Not reported |
| 6.5 Medium severity | Apple Multiple Products WebKit Out-of-Bounds Read CVE-2023-42916 | Dec 4, 2023 | Dec 25, 2023 | Not reported |
| 9.6 Critical severity | Google Skia Integer Overflow CVE-2023-6345 | Nov 30, 2023 | Dec 21, 2023 | Not reported |
| 7.5 High severity | ownCloud graphapi Information Disclosure CVE-2023-49103 | Nov 30, 2023 | Dec 21, 2023 | Not reported |
| 7.8 High severity | GNU C Library Buffer Overflow CVE-2023-4911 | Nov 21, 2023 | Dec 12, 2023 | Not reported |
| 5.4 Medium severity | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass CVE-2023-36584 | Nov 16, 2023 | Dec 7, 2023 | Not reported |
| 9.8 Critical severity | Sophos Web Appliance Command Injection CVE-2023-1671 | Nov 16, 2023 | Dec 7, 2023 | Not reported |
| 9.8 Critical severity | Oracle Fusion Middleware Unspecified CVE-2020-2551 | Nov 16, 2023 | Dec 7, 2023 | Not reported |
| 7.8 High severity | Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation CVE-2023-36036 | Nov 14, 2023 | Dec 5, 2023 | Not reported |
| 7.8 High severity | Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation CVE-2023-36033 | Nov 14, 2023 | Dec 5, 2023 | Not reported |
| 8.8 High severity | Microsoft Windows SmartScreen Security Feature Bypass CVE-2023-36025 | Nov 14, 2023 | Dec 5, 2023 | Not reported |
| 9.8 Critical severity | SysAid Server Path Traversal CVE-2023-47246 | Nov 13, 2023 | Dec 4, 2023 | Known |
| 5.3 Medium severity | Juniper Junos OS SRX Series Missing Authentication for Critical Function CVE-2023-36851 | Nov 13, 2023 | Nov 17, 2023 | Not reported |
| 5.3 Medium severity | Juniper Junos OS EX Series Missing Authentication for Critical Function CVE-2023-36847 | Nov 13, 2023 | Nov 17, 2023 | Not reported |
| 5.3 Medium severity | Juniper Junos OS SRX Series Missing Authentication for Critical Function CVE-2023-36846 | Nov 13, 2023 | Nov 17, 2023 | Not reported |
| 9.8 Critical severity | Juniper Junos OS EX Series and SRX Series PHP External Variable Modification CVE-2023-36845 | Nov 13, 2023 | Nov 17, 2023 | Not reported |
| 5.3 Medium severity | Juniper Junos OS EX Series PHP External Variable Modification CVE-2023-36844 | Nov 13, 2023 | Nov 17, 2023 | Not reported |
| 7.5 High severity | Service Location Protocol (SLP) Denial-of-Service CVE-2023-29552 | Nov 8, 2023 | Nov 29, 2023 | Not reported |
| 9.8 Critical severity | Atlassian Confluence Data Center and Server Improper Authorization CVE-2023-22518 | Nov 7, 2023 | Nov 28, 2023 | Known |
| 9.8 Critical severity | Apache ActiveMQ Deserialization of Untrusted Data CVE-2023-46604 | Nov 2, 2023 | Nov 23, 2023 | Known |
| 8.8 High severity | F5 BIG-IP Configuration Utility SQL Injection CVE-2023-46748 | Oct 31, 2023 | Nov 21, 2023 | Not reported |
| 9.8 Critical severity | F5 BIG-IP Configuration Utility Authentication Bypass CVE-2023-46747 | Oct 31, 2023 | Nov 21, 2023 | Known |
| 5.4 Medium severity | Roundcube Webmail Persistent Cross-Site Scripting (XSS) CVE-2023-5631 | Oct 26, 2023 | Nov 16, 2023 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.