Vulnerabilities exploited in the wild
1,781 vulnerabilities that attackers have used in real attacks, as confirmed by the US Cybersecurity and Infrastructure Security Agency (CISA). If you run an affected product, these come before everything else in your patch queue.
| Score | Vulnerability | Added | Federal deadline | Ransomware use |
|---|---|---|---|---|
| 7.5 High severity | Microsoft .NET Core and Visual Studio Denial-of-Service CVE-2023-38180 | Aug 9, 2023 | Aug 30, 2023 | Not reported |
| 9.8 Critical severity | Zyxel P660HN-T1A Routers Command Injection CVE-2017-18368 | Aug 7, 2023 | Aug 28, 2023 | Not reported |
| 7.2 High severity | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal CVE-2023-35081 | Jul 31, 2023 | Aug 21, 2023 | Not reported |
| 6.1 Medium severity | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) CVE-2023-37580 | Jul 27, 2023 | Aug 17, 2023 | Not reported |
| 5.5 Medium severity | Apple Multiple Products Kernel Unspecified CVE-2023-38606 | Jul 26, 2023 | Aug 16, 2023 | Not reported |
| 9.8 Critical severity | Ivanti Endpoint Manager Mobile Authentication Bypass CVE-2023-35078 | Jul 25, 2023 | Aug 15, 2023 | Known |
| 7.5 High severity | Adobe ColdFusion Improper Access Control CVE-2023-38205 | Jul 20, 2023 | Aug 10, 2023 | Not reported |
| 7.5 High severity | Adobe ColdFusion Improper Access Control CVE-2023-29298 | Jul 20, 2023 | Aug 10, 2023 | Not reported |
| 9.8 Critical severity | Citrix NetScaler ADC and NetScaler Gateway Code Injection CVE-2023-3519 | Jul 19, 2023 | Aug 9, 2023 | Known |
| 7.5 High severity | Microsoft Windows Search Remote Code Execution CVE-2023-36884 | Jul 17, 2023 | Aug 29, 2023 | Known |
| 8.8 High severity | Apple Multiple Products WebKit Code Execution CVE-2023-37450 | Jul 13, 2023 | Aug 3, 2023 | Not reported |
| 9.8 Critical severity | SolarView Compact Command Injection CVE-2022-29303 | Jul 13, 2023 | Aug 3, 2023 | Not reported |
| 7.8 High severity | Microsoft Windows Error Reporting Service Privilege Escalation CVE-2023-36874 | Jul 11, 2023 | Aug 1, 2023 | Not reported |
| 7.5 High severity | Microsoft Outlook Security Feature Bypass CVE-2023-35311 | Jul 11, 2023 | Aug 1, 2023 | Not reported |
| 8.8 High severity | Microsoft Windows Defender SmartScreen Security Feature Bypass CVE-2023-32049 | Jul 11, 2023 | Aug 1, 2023 | Not reported |
| 7.8 High severity | Microsoft Windows MSHTML Platform Privilege Escalation CVE-2023-32046 | Jul 11, 2023 | Aug 1, 2023 | Not reported |
| 9.8 Critical severity | Netwrix Auditor Insecure Object Deserialization CVE-2022-31199 | Jul 11, 2023 | Aug 1, 2023 | Known |
| 8.8 High severity | Arm Mali GPU Kernel Driver Use-After-Free CVE-2021-29256 | Jul 7, 2023 | Jul 28, 2023 | Not reported |
| 5.5 Medium severity | Samsung Mobile Devices Improper Input Validation CVE-2021-25489 | Jun 29, 2023 | Jul 20, 2023 | Not reported |
| 7.8 High severity | Samsung Mobile Devices Out-of-Bounds Read CVE-2021-25487 | Jun 29, 2023 | Jul 20, 2023 | Not reported |
| 6.4 Medium severity | Samsung Mobile Devices Race Condition CVE-2021-25395 | Jun 29, 2023 | Jul 20, 2023 | Not reported |
| 6.4 Medium severity | Samsung Mobile Devices Race Condition CVE-2021-25394 | Jun 29, 2023 | Jul 20, 2023 | Not reported |
| 6.7 Medium severity | Samsung Mobile Devices Improper Boundary Check CVE-2021-25372 | Jun 29, 2023 | Jul 20, 2023 | Not reported |
| 6.7 Medium severity | Samsung Mobile Devices Unspecified CVE-2021-25371 | Jun 29, 2023 | Jul 20, 2023 | Not reported |
| 7.8 High severity | D-Link DWL-2600AP Access Point Command Injection CVE-2019-20500 | Jun 29, 2023 | Jul 20, 2023 | Not reported |
| 9.8 Critical severity | D-Link DIR-859 Router Command Execution CVE-2019-17621 | Jun 29, 2023 | Jul 20, 2023 | Not reported |
| 8.8 High severity | Apple Multiple Products WebKit Type Confusion CVE-2023-32439 | Jun 23, 2023 | Jul 14, 2023 | Not reported |
| 8.8 High severity | Apple Multiple Products WebKit Memory Corruption CVE-2023-32435 | Jun 23, 2023 | Jul 14, 2023 | Not reported |
| 7.8 High severity | Apple Multiple Products Integer Overflow CVE-2023-32434 | Jun 23, 2023 | Jul 14, 2023 | Not reported |
| 9.8 Critical severity | Zyxel Multiple NAS Devices Command Injection CVE-2023-27992 | Jun 23, 2023 | Jul 14, 2023 | Not reported |
| 3.9 Low severity | VMware Tools Authentication Bypass CVE-2023-20867 | Jun 23, 2023 | Jul 14, 2023 | Not reported |
| 9.8 Critical severity | Vmware Aria Operations for Networks Command Injection CVE-2023-20887 | Jun 22, 2023 | Jul 13, 2023 | Not reported |
| 9.8 Critical severity | Roundcube Webmail SQL Injection CVE-2021-44026 | Jun 22, 2023 | Jul 13, 2023 | Not reported |
| 6.1 Medium severity | Roundcube Webmail Cross-Site Scripting (XSS) CVE-2020-35730 | Jun 22, 2023 | Jul 13, 2023 | Not reported |
| 9.8 Critical severity | Roundcube Webmail Remote Code Execution CVE-2020-12641 | Jun 22, 2023 | Jul 13, 2023 | Not reported |
| 7.5 High severity | Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free CVE-2016-9079 | Jun 22, 2023 | Jul 13, 2023 | Not reported |
| 7.8 High severity | Microsoft Win32k Privilege Escalation CVE-2016-0165 | Jun 22, 2023 | Jul 13, 2023 | Not reported |
| 9.8 Critical severity | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow CVE-2023-27997 | Jun 13, 2023 | Jul 4, 2023 | Known |
| 8.8 High severity | Google Chromium V8 Type Confusion CVE-2023-3079 | Jun 7, 2023 | Jun 28, 2023 | Not reported |
| 9.8 Critical severity | Zyxel Multiple Firewalls Buffer Overflow CVE-2023-33010 | Jun 5, 2023 | Jun 26, 2023 | Not reported |
About this list
CISA adds a vulnerability to its Known Exploited Vulnerabilities (KEV) catalogue only when there is reliable evidence of exploitation and a clear fix or mitigation. US federal agencies must remediate each entry by the deadline shown; everyone else can treat the list as a short, evidence-based set of must-patch issues.
A vulnerability missing from this list is not proof that it is safe. Many exploited flaws are never catalogued, which is why each of our CVE pages also shows the EPSS exploitation forecast.