Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2024-0519 | Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap… | Google / Chromium V8 | Jan 17, 2024 | — | View → |
| CVE-2018-15133 | Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability… | Laravel / Laravel Framework | Jan 16, 2024 | — | View → |
| CVE-2023-29357 | Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to… | Microsoft / SharePoint Server | Jan 10, 2024 | Ransomware | View → |
| CVE-2023-46805 | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass… | Ivanti / Connect Secure and Policy Secure | Jan 10, 2024 | Ransomware | View → |
| CVE-2024-21887 | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in… | Ivanti / Connect Secure and Policy Secure | Jan 10, 2024 | Ransomware | View → |
| CVE-2016-20017 | D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi… | D-Link / DSL-2750B Devices | Jan 8, 2024 | — | View → |
| CVE-2023-23752 | Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints. | Joomla! / Joomla! | Jan 8, 2024 | — | View → |
| CVE-2023-27524 | Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access… | Apache / Superset | Jan 8, 2024 | — | View → |
| CVE-2023-29300 | Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. | Adobe / ColdFusion | Jan 8, 2024 | Ransomware | View → |
| CVE-2023-38203 | Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. | Adobe / ColdFusion | Jan 8, 2024 | Ransomware | View → |
| CVE-2023-41990 | Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file. | Apple / Multiple Products | Jan 8, 2024 | — | View → |
| CVE-2023-7024 | Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow… | Google / Chromium WebRTC | Jan 2, 2024 | — | View → |
| CVE-2023-7101 | Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type… | Spreadsheet::ParseExcel / Spreadsheet::ParseExcel | Jan 2, 2024 | — | View → |
| CVE-2023-47565 | QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network. | QNAP / VioStor NVR | Dec 21, 2023 | — | View → |
| CVE-2023-49897 | FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network. | FXC / AE1021, AE1021PE | Dec 21, 2023 | — | View → |
| CVE-2023-6448 | Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute… | Unitronics / Vision PLC and HMI | Dec 11, 2023 | — | View → |
| CVE-2023-41265 | Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the… | Qlik / Sense | Dec 7, 2023 | Ransomware | View → |
| CVE-2023-41266 | Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by… | Qlik / Sense | Dec 7, 2023 | Ransomware | View → |
| CVE-2022-22071 | Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process… | Qualcomm / Multiple Chipsets | Dec 5, 2023 | — | View → |
| CVE-2023-33063 | Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS… | Qualcomm / Multiple Chipsets | Dec 5, 2023 | — | View → |