Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.2 High severity | Cisco IOS XE Web UI Command Injection CVE-2023-20273 | Oct 23, 2023 | Oct 27, 2023 | Not reported |
| 7.5 High severity | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow CVE-2023-4966 | Oct 18, 2023 | Nov 8, 2023 | Known |
| 10.0 Critical severity | Cisco IOS XE Web UI Privilege Escalation CVE-2023-20198 | Oct 16, 2023 | Oct 20, 2023 | Not reported |
| 7.5 High severity | HTTP/2 Rapid Reset Attack CVE-2023-44487 | Oct 10, 2023 | Oct 31, 2023 | Not reported |
| 5.3 Medium severity | Microsoft Skype for Business Privilege Escalation CVE-2023-41763 | Oct 10, 2023 | Oct 31, 2023 | Not reported |
| 5.5 Medium severity | Microsoft WordPad Information Disclosure CVE-2023-36563 | Oct 10, 2023 | Oct 31, 2023 | Not reported |
| 7.8 High severity | Adobe Acrobat and Reader Use-After-Free CVE-2023-21608 | Oct 10, 2023 | Oct 31, 2023 | Not reported |
| 6.6 Medium severity | Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write CVE-2023-20109 | Oct 10, 2023 | Oct 31, 2023 | Not reported |
| 7.8 High severity | Apple iOS and iPadOS Kernel Privilege Escalation CVE-2023-42824 | Oct 5, 2023 | Oct 26, 2023 | Not reported |
| 8.8 High severity | Progress WS_FTP Server Deserialization of Untrusted Data CVE-2023-40044 | Oct 5, 2023 | Oct 26, 2023 | Known |
| 9.8 Critical severity | Atlassian Confluence Data Center and Server Broken Access Control CVE-2023-22515 | Oct 5, 2023 | Oct 13, 2023 | Known |
| 9.8 Critical severity | JetBrains TeamCity Authentication Bypass CVE-2023-42793 | Oct 4, 2023 | Oct 25, 2023 | Known |
| 7.0 High severity | Microsoft Windows CNG Key Isolation Service Privilege Escalation CVE-2023-28229 | Oct 4, 2023 | Oct 25, 2023 | Not reported |
| 5.5 Medium severity | Arm Mali GPU Kernel Driver Use-After-Free CVE-2023-4211 | Oct 3, 2023 | Oct 24, 2023 | Not reported |
| 8.8 High severity | Google Chromium libvpx Heap Buffer Overflow CVE-2023-5217 | Oct 2, 2023 | Oct 23, 2023 | Not reported |
| 9.8 Critical severity | Red Hat JBoss RichFaces Framework Expression Language Injection CVE-2018-14667 | Sep 28, 2023 | Oct 19, 2023 | Not reported |
| 8.8 High severity | Apple Multiple Products WebKit Code Execution CVE-2023-41993 | Sep 25, 2023 | Oct 16, 2023 | Not reported |
| 7.8 High severity | Apple Multiple Products Kernel Privilege Escalation CVE-2023-41992 | Sep 25, 2023 | Oct 16, 2023 | Not reported |
| 5.5 Medium severity | Apple Multiple Products Improper Certificate Validation CVE-2023-41991 | Sep 25, 2023 | Oct 16, 2023 | Not reported |
| 7.2 High severity | Trend Micro Apex One and Worry-Free Business Security Remote Code Execution CVE-2023-41179 | Sep 21, 2023 | Oct 12, 2023 | Not reported |
| 8.8 High severity | MinIO Security Feature Bypass CVE-2023-28434 | Sep 19, 2023 | Oct 10, 2023 | Not reported |
| 7.8 High severity | Samsung Mobile Devices Use-After-Free CVE-2022-22265 | Sep 18, 2023 | Oct 9, 2023 | Not reported |
| 9.8 Critical severity | Laravel Ignition File Upload CVE-2021-3129 | Sep 18, 2023 | Oct 9, 2023 | Known |
| 8.8 High severity | Zyxel EMG2926 Routers Command Injection CVE-2017-6884 | Sep 18, 2023 | Oct 9, 2023 | Known |
| 9.8 Critical severity | Realtek SDK Improper Input Validation CVE-2014-8361 | Sep 18, 2023 | Oct 9, 2023 | Not reported |
| 7.8 High severity | Adobe Acrobat and Reader Out-of-Bounds Write CVE-2023-26369 | Sep 14, 2023 | Oct 5, 2023 | Not reported |
| 8.8 High severity | Google Chromium WebP Heap-Based Buffer Overflow CVE-2023-4863 | Sep 13, 2023 | Oct 4, 2023 | Not reported |
| 7.8 High severity | Android Framework Privilege Escalation CVE-2023-35674 | Sep 13, 2023 | Oct 4, 2023 | Not reported |
| 9.1 Critical severity | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access CVE-2023-20269 | Sep 13, 2023 | Oct 4, 2023 | Known |
| 7.8 High severity | Microsoft Streaming Service Proxy Privilege Escalation CVE-2023-36802 | Sep 12, 2023 | Oct 3, 2023 | Not reported |
| 6.5 Medium severity | Microsoft Word Information Disclosure CVE-2023-36761 | Sep 12, 2023 | Oct 3, 2023 | Not reported |
| 7.8 High severity | Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow CVE-2023-41064 | Sep 11, 2023 | Oct 2, 2023 | Not reported |
| 7.8 High severity | Apple iOS, iPadOS, and watchOS Wallet Code Execution CVE-2023-41061 | Sep 11, 2023 | Oct 2, 2023 | Not reported |
| 9.8 Critical severity | Apache RocketMQ Command Execution CVE-2023-33246 | Sep 6, 2023 | Sep 27, 2023 | Not reported |
| 7.8 High severity | RARLAB WinRAR Code Execution CVE-2023-38831 | Aug 24, 2023 | Sep 14, 2023 | Known |
| 7.5 High severity | Ignite Realtime Openfire Path Traversal CVE-2023-32315 | Aug 24, 2023 | Sep 14, 2023 | Not reported |
| 9.8 Critical severity | Ivanti Sentry Authentication Bypass CVE-2023-38035 | Aug 22, 2023 | Sep 12, 2023 | Known |
| 7.5 High severity | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function CVE-2023-27532 | Aug 22, 2023 | Sep 12, 2023 | Known |
| 9.8 Critical severity | Adobe ColdFusion Deserialization of Untrusted Data CVE-2023-26359 | Aug 21, 2023 | Sep 11, 2023 | Not reported |
| 9.8 Critical severity | Citrix Content Collaboration ShareFile Improper Access Control CVE-2023-24489 | Aug 16, 2023 | Sep 6, 2023 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.