Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2024-30051 | Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges. | Microsoft / DWM Core Library | May 14, 2024 | Ransomware | View → |
| CVE-2024-4671 | Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted… | Google / Chromium | May 13, 2024 | — | View → |
| CVE-2023-7028 | GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password… | GitLab / GitLab CE/EE | May 1, 2024 | — | View → |
| CVE-2024-29988 | Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW)… | Microsoft / SmartScreen Prompt | Apr 30, 2024 | — | View → |
| CVE-2024-20353 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote… | Cisco / Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Apr 24, 2024 | — | View → |
| CVE-2024-20359 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow… | Cisco / Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Apr 24, 2024 | — | View → |
| CVE-2024-4040 | CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system… | CrushFTP / CrushFTP | Apr 24, 2024 | — | View → |
| CVE-2022-38028 | Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints… | Microsoft / Windows | Apr 23, 2024 | — | View → |
| CVE-2024-3400 | Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to… | Palo Alto Networks / PAN-OS | Apr 12, 2024 | Ransomware | View → |
| CVE-2024-3272 | D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command… | D-Link / Multiple NAS Devices | Apr 11, 2024 | — | View → |
| CVE-2024-3273 | D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can… | D-Link / Multiple NAS Devices | Apr 11, 2024 | — | View → |
| CVE-2024-29745 | Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking… | Android / Pixel | Apr 4, 2024 | — | View → |
| CVE-2024-29748 | Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device… | Android / Pixel | Apr 4, 2024 | — | View → |
| CVE-2023-24955 | Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to… | Microsoft / SharePoint Server | Mar 26, 2024 | Ransomware | View → |
| CVE-2019-7256 | Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution. | Nice / Linear eMerge E3-Series | Mar 25, 2024 | — | View → |
| CVE-2021-44529 | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to… | Ivanti / Endpoint Manager Cloud Service Appliance (EPM CSA) | Mar 25, 2024 | Ransomware | View → |
| CVE-2023-48788 | Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via… | Fortinet / FortiClient EMS | Mar 25, 2024 | Ransomware | View → |
| CVE-2024-27198 | JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. | JetBrains / TeamCity | Mar 7, 2024 | Ransomware | View → |
| CVE-2024-23225 | Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with… | Apple / Multiple Products | Mar 6, 2024 | — | View → |
| CVE-2024-23296 | Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel… | Apple / Multiple Products | Mar 6, 2024 | — | View → |