Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2024-38189 | Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. | Microsoft / Project | Aug 13, 2024 | — | View → |
| CVE-2024-38193 | Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation,… | Microsoft / Windows | Aug 13, 2024 | — | View → |
| CVE-2024-38213 | Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user… | Microsoft / Windows | Aug 13, 2024 | — | View → |
| CVE-2024-32113 | Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. | Apache / OFBiz | Aug 7, 2024 | — | View → |
| CVE-2024-36971 | Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux… | Android / Kernel | Aug 7, 2024 | — | View → |
| CVE-2018-0824 | Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code… | Microsoft / Windows | Aug 5, 2024 | — | View → |
| CVE-2024-37085 | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain… | VMware / ESXi | Jul 30, 2024 | Ransomware | View → |
| CVE-2023-45249 | Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords. | Acronis / Cyber Infrastructure (ACI) | Jul 29, 2024 | — | View → |
| CVE-2024-4879 | ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An… | ServiceNow / Utah, Vancouver, and Washington DC Now Platform | Jul 29, 2024 | — | View → |
| CVE-2024-5217 | ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in… | ServiceNow / Utah, Vancouver, and Washington DC Now Platform | Jul 29, 2024 | — | View → |
| CVE-2012-4792 | Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted… | Microsoft / Internet Explorer | Jul 23, 2024 | — | View → |
| CVE-2024-39891 | Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request… | Twilio / Authy | Jul 23, 2024 | — | View → |
| CVE-2022-22948 | VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain… | VMware / vCenter Server | Jul 17, 2024 | — | View → |
| CVE-2024-28995 | SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine. | SolarWinds / Serv-U | Jul 17, 2024 | — | View → |
| CVE-2024-34102 | Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows… | Adobe / Commerce and Magento Open Source | Jul 17, 2024 | — | View → |
| CVE-2024-36401 | OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely… | OSGeo / GeoServer | Jul 15, 2024 | — | View → |
| CVE-2024-23692 | Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a… | Rejetto / HTTP File Server | Jul 9, 2024 | Ransomware | View → |
| CVE-2024-38080 | Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM… | Microsoft / Windows | Jul 9, 2024 | — | View → |
| CVE-2024-38112 | Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability. | Microsoft / Windows | Jul 9, 2024 | — | View → |
| CVE-2024-20399 | Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local… | Cisco / NX-OS | Jul 2, 2024 | — | View → |