Known Exploited Vulnerabilities
A KEV is a CVE that CISA has confirmed is being actively exploited in the wild. Search the full catalog below, or check a specific package on the lookup page.
| CVE ID | Description | Vendor / Product | Added | Ransomware | Details |
|---|---|---|---|---|---|
| CVE-2023-33106 | Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while… | Qualcomm / Multiple Chipsets | Dec 5, 2023 | — | View → |
| CVE-2023-33107 | Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared… | Qualcomm / Multiple Chipsets | Dec 5, 2023 | — | View → |
| CVE-2023-42916 | Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when… | Apple / Multiple Products | Dec 4, 2023 | — | View → |
| CVE-2023-42917 | Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing… | Apple / Multiple Products | Dec 4, 2023 | — | View → |
| CVE-2023-49103 | ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php,… | ownCloud / ownCloud graphapi | Nov 30, 2023 | — | View → |
| CVE-2023-6345 | Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process,… | Google / Chromium Skia | Nov 30, 2023 | — | View → |
| CVE-2023-4911 | GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable,… | GNU / GNU C Library | Nov 21, 2023 | — | View → |
| CVE-2020-2551 | Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with… | Oracle / Fusion Middleware | Nov 16, 2023 | — | View → |
| CVE-2023-1671 | Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution. | Sophos / Web Appliance | Nov 16, 2023 | — | View → |
| CVE-2023-36584 | Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and… | Microsoft / Windows | Nov 16, 2023 | — | View → |
| CVE-2023-36025 | Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender… | Microsoft / Windows | Nov 14, 2023 | — | View → |
| CVE-2023-36033 | Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. | Microsoft / Windows | Nov 14, 2023 | — | View → |
| CVE-2023-36036 | Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM… | Microsoft / Windows | Nov 14, 2023 | — | View → |
| CVE-2023-36844 | Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based… | Juniper / Junos OS | Nov 13, 2023 | — | View → |
| CVE-2023-36845 | Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated,… | Juniper / Junos OS | Nov 13, 2023 | — | View → |
| CVE-2023-36846 | Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated,… | Juniper / Junos OS | Nov 13, 2023 | — | View → |
| CVE-2023-36847 | Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated,… | Juniper / Junos OS | Nov 13, 2023 | — | View → |
| CVE-2023-36851 | Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated,… | Juniper / Junos OS | Nov 13, 2023 | — | View → |
| CVE-2023-47246 | SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution. | SysAid / SysAid Server | Nov 13, 2023 | Ransomware | View → |
| CVE-2023-29552 | The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker… | IETF / Service Location Protocol (SLP) | Nov 8, 2023 | — | View → |