KEV / Archive / 2024
KEV additions in 2024
Every vulnerability CISA added to the Known Exploited Vulnerabilities catalog in 2024, with monthly counts, vendors and weaknesses.
Answer CISA added 186 vulnerabilities to the KEV catalog in 2024. The busiest month was September 2024, with 25. 44 were flagged as used by ransomware (23.7%), and the most-listed vendor was Microsoft with 36.
- Added
- 186in 2024
- Ransomware: known
- 23.7%44 entries
- Vendors
- 64distinct
- Median days to due
- 21dateAdded to dueDate
- Share of catalog
- 10.8%of 1,721
MAdditions per month
Table view
| Month | Added |
|---|---|
| Jan 24 | 21 |
| Feb 24 | 9 |
| Mar 24 | 10 |
| Apr 24 | 10 |
| May 24 | 14 |
| Jun 24 | 9 |
| Jul 24 | 14 |
| Aug 24 | 19 |
| Sep 24 | 25 |
| Oct 24 | 17 |
| Nov 24 | 22 |
| Dec 24 | 16 |
VTop vendors in 2024
WTop weaknesses in 2024
| CWE | Entries | Share of year |
|---|---|---|
| CWE-78 OS command injection | 14 | 7.5% |
| CWE-502 Unsafe deserialization | 11 | 5.9% |
| CWE-416 Use after free | 10 | 5.4% |
| CWE-287 Improper authentication | 9 | 4.8% |
| CWE-22 Path traversal | 9 | 4.8% |
| CWE-77 Command injection | 7 | 3.8% |
| CWE-787 Out-of-bounds write | 7 | 3.8% |
| CWE-284 Improper access control | 6 | 3.2% |
EAll 186 entries added in 2024
| CVE | Vendor | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|---|
| CVE-2024-3393 | Palo Alto Networks | PAN-OS | Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability | Unknown | CWE-754 | ||
| CVE-2021-44207 | Acclaim Systems | USAHERDS | Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability | Unknown | CWE-798 | ||
| CVE-2024-12356 | BeyondTrust | Privileged Remote Access (PRA) and Remote Support (RS) | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability | Unknown | CWE-77 | ||
| CVE-2022-23227 | NUUO | NVRmini2 Devices | NUUO NVRmini2 Devices Missing Authentication Vulnerability | Unknown | CWE-306 | ||
| CVE-2021-40407 | Reolink | RLC-410W IP Camera | Reolink RLC-410W IP Camera OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2019-11001 | Reolink | Multiple IP Cameras | Reolink Multiple IP Cameras OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2018-14933 | NUUO | NVRmini Devices | NUUO NVRmini Devices OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2024-55956 | Cleo | Multiple Products | Cleo Multiple Products Unauthenticated File Upload Vulnerability | Known | CWE-276 | ||
| CVE-2024-35250 | Microsoft | Windows | Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability | Unknown | CWE-822 | ||
| CVE-2024-20767 | Adobe | ColdFusion | Adobe ColdFusion Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2024-50623 | Cleo | Multiple Products | Cleo Multiple Products Unrestricted File Upload Vulnerability | Known | CWE-434 | ||
| CVE-2024-49138 | Microsoft | Windows | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2024-51378 | CyberPersons | CyberPanel | CyberPanel Incorrect Default Permissions Vulnerability | Known | CWE-276 | ||
| CVE-2024-11680 | ProjectSend | ProjectSend | ProjectSend Improper Authentication Vulnerability | Unknown | CWE-287 | ||
| CVE-2024-11667 | Zyxel | Multiple Firewalls | Zyxel Multiple Firewalls Path Traversal Vulnerability | Known | CWE-22 | ||
| CVE-2023-45727 | North Grid | Proself | North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability | Unknown | CWE-611 | ||
| CVE-2023-28461 | Array Networks | AG/vxAG ArrayOS | Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability | Known | CWE-306 | ||
| CVE-2024-44309 | Apple | Multiple Products | Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2024-44308 | Apple | Multiple Products | Apple Multiple Products Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2024-21287 | Oracle | Agile Product Lifecycle Management (PLM) | Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability | Unknown | CWE-863 | ||
| CVE-2024-38813 | VMware | vCenter Server | VMware vCenter Server Privilege Escalation Vulnerability | Unknown | CWE-250, CWE-273 | ||
| CVE-2024-38812 | VMware | vCenter Server | VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2024-9474 | Palo Alto Networks | PAN-OS | Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability | Known | CWE-77 | ||
| CVE-2024-1212 | Progress | Kemp LoadMaster | Progress Kemp LoadMaster OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2024-0012 | Palo Alto Networks | PAN-OS | Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability | Known | CWE-306 | ||
| CVE-2024-9465 | Palo Alto Networks | Expedition | Palo Alto Networks Expedition SQL Injection Vulnerability | Unknown | CWE-89 | ||
| CVE-2024-9463 | Palo Alto Networks | Expedition | Palo Alto Networks Expedition OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2024-49039 | Microsoft | Windows | Microsoft Windows Task Scheduler Privilege Escalation Vulnerability | Known | CWE-287 | ||
| CVE-2024-43451 | Microsoft | Windows | Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability | Unknown | CWE-73 | ||
| CVE-2021-41277 | Metabase | Metabase | Metabase GeoJSON API Local File Inclusion Vulnerability | Unknown | CWE-200 | ||
| CVE-2021-26086 | Atlassian | Jira Server and Data Center | Atlassian Jira Server and Data Center Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2014-2120 | Cisco | Adaptive Security Appliance (ASA) | Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2024-5910 | Palo Alto Networks | Expedition | Palo Alto Networks Expedition Missing Authentication Vulnerability | Unknown | CWE-306 | ||
| CVE-2024-51567 | CyberPersons | CyberPanel | CyberPanel Incorrect Default Permissions Vulnerability | Known | CWE-276 | ||
| CVE-2024-43093 | Android | Framework | Android Framework Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-16278 | Nostromo | nhttpd | Nostromo nhttpd Directory Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2024-8957 | PTZOptics | PT30X-SDI/NDI Cameras | PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2024-8956 | PTZOptics | PT30X-SDI/NDI Cameras | PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability | Unknown | CWE-287 | ||
| CVE-2024-37383 | Roundcube | Webmail | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2024-20481 | Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Denial-of-Service Vulnerability | Unknown | CWE-772 | ||
| CVE-2024-47575 | Fortinet | FortiManager | Fortinet FortiManager Missing Authentication Vulnerability | Unknown | CWE-306 | ||
| CVE-2024-38094 | Microsoft | SharePoint | Microsoft SharePoint Deserialization Vulnerability | Known | CWE-502 | ||
| CVE-2024-9537 | ScienceLogic | SL1 | ScienceLogic SL1 Unspecified Vulnerability | Unknown | none listed | ||
| CVE-2024-40711 | Veeam | Backup & Replication | Veeam Backup and Replication Deserialization Vulnerability | Known | CWE-502 | ||
| CVE-2024-9680 | Mozilla | Firefox | Mozilla Firefox Use-After-Free Vulnerability | Known | CWE-416 | ||
| CVE-2024-30088 | Microsoft | Windows | Microsoft Windows Kernel TOCTOU Race Condition Vulnerability | Known | CWE-367 | ||
| CVE-2024-28987 | SolarWinds | Web Help Desk | SolarWinds Web Help Desk Hardcoded Credential Vulnerability | Unknown | CWE-798 | ||
| CVE-2024-9380 | Ivanti | Cloud Services Appliance (CSA) | Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability | Unknown | CWE-77 | ||
| CVE-2024-9379 | Ivanti | Cloud Services Appliance (CSA) | Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability | Unknown | CWE-89 | ||
| CVE-2024-23113 | Fortinet | Multiple Products | Fortinet Multiple Products Format String Vulnerability | Unknown | CWE-134 | ||
| CVE-2024-43573 | Microsoft | Windows | Microsoft Windows MSHTML Platform Spoofing Vulnerability | Unknown | CWE-79 | ||
| CVE-2024-43572 | Microsoft | Windows | Microsoft Windows Management Console Remote Code Execution Vulnerability | Unknown | CWE-707 | ||
| CVE-2024-43047 | Qualcomm | Multiple Chipsets | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2024-45519 | Synacor | Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability | Unknown | CWE-284 | ||
| CVE-2024-29824 | Ivanti | Endpoint Manager (EPM) | Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability | Unknown | CWE-89 | ||
| CVE-2023-25280 | D-Link | DIR-820 Router | D-Link DIR-820 Router OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2020-15415 | DrayTek | Multiple Vigor Routers | DrayTek Multiple Vigor Routers OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2019-0344 | SAP | Commerce Cloud | SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2024-7593 | Ivanti | Virtual Traffic Manager | Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability | Unknown | CWE-287, CWE-303 | ||
| CVE-2024-8963 | Ivanti | Cloud Services Appliance (CSA) | Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2024-27348 | Apache | HugeGraph-Server | Apache HugeGraph-Server Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2022-21445 | Oracle | ADF Faces | Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2020-14644 | Oracle | WebLogic Server | Oracle WebLogic Server Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2020-0618 | Microsoft | SQL Server | Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability | Known | CWE-502 | ||
| CVE-2014-0502 | Adobe | Flash Player | Adobe Flash Player Double Free Vulnerablity | Unknown | CWE-399 | ||
| CVE-2014-0497 | Adobe | Flash Player | Adobe Flash Player Integer Underflow Vulnerablity | Unknown | CWE-191 | ||
| CVE-2013-0648 | Adobe | Flash Player | Adobe Flash Player Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2013-0643 | Adobe | Flash Player | Adobe Flash Player Incorrect Default Permissions Vulnerability | Unknown | CWE-264 | ||
| CVE-2024-6670 | Progress | WhatsUp Gold | Progress WhatsUp Gold SQL Injection Vulnerability | Known | CWE-89 | ||
| CVE-2024-43461 | Microsoft | Windows | Microsoft Windows MSHTML Platform Spoofing Vulnerability | Unknown | CWE-451 | ||
| CVE-2024-8190 | Ivanti | Cloud Services Appliance | Ivanti Cloud Services Appliance OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2024-38226 | Microsoft | Publisher | Microsoft Publisher Protection Mechanism Failure Vulnerability | Unknown | CWE-693 | ||
| CVE-2024-38217 | Microsoft | Windows | Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability | Unknown | CWE-693 | ||
| CVE-2024-38014 | Microsoft | Windows | Microsoft Windows Installer Improper Privilege Management Vulnerability | Unknown | CWE-269 | ||
| CVE-2024-40766 | SonicWall | SonicOS | SonicWall SonicOS Improper Access Control Vulnerability | Known | CWE-284 | ||
| CVE-2017-1000253 | Linux | Kernel | Linux Kernel PIE Stack Buffer Corruption Vulnerability | Known | CWE-119 | ||
| CVE-2016-3714 | ImageMagick | ImageMagick | ImageMagick Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2024-7262 | Kingsoft | WPS Office | Kingsoft WPS Office Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2021-20124 | DrayTek | VigorConnect | Draytek VigorConnect Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2021-20123 | DrayTek | VigorConnect | Draytek VigorConnect Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2024-7965 | Chromium V8 | Google Chromium V8 Inappropriate Implementation Vulnerability | Unknown | CWE-358 | |||
| CVE-2024-38856 | Apache | OFBiz | Apache OFBiz Incorrect Authorization Vulnerability | Unknown | CWE-863 | ||
| CVE-2024-7971 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | |||
| CVE-2024-39717 | Versa | Director | Versa Director Dangerous File Type Upload Vulnerability | Unknown | CWE-434 | ||
| CVE-2022-0185 | Linux | Kernel | Linux Kernel Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-190 | ||
| CVE-2021-33045 | Dahua | IP Camera Firmware | Dahua IP Camera Authentication Bypass Vulnerability | Unknown | CWE-287 | ||
| CVE-2021-33044 | Dahua | IP Camera Firmware | Dahua IP Camera Authentication Bypass Vulnerability | Unknown | CWE-287 | ||
| CVE-2021-31196 | Microsoft | Exchange Server | Microsoft Exchange Server Information Disclosure Vulnerability | Unknown | none listed | ||
| CVE-2024-23897 | Jenkins | Jenkins Command Line Interface (CLI) | Jenkins Command Line Interface (CLI) Path Traversal Vulnerability | Known | CWE-27 | ||
| CVE-2024-28986 | SolarWinds | Web Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2024-38213 | Microsoft | Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | Unknown | CWE-693 | ||
| CVE-2024-38193 | Microsoft | Windows | Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2024-38189 | Microsoft | Project | Microsoft Project Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2024-38178 | Microsoft | Windows | Microsoft Windows Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-843 | ||
| CVE-2024-38107 | Microsoft | Windows | Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2024-38106 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-591 | ||
| CVE-2024-36971 | Android | Kernel | Android Kernel Remote Code Execution Vulnerability | Unknown | CWE-416 | ||
| CVE-2024-32113 | Apache | OFBiz | Apache OFBiz Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2018-0824 | Microsoft | Windows | Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2024-37085 | VMware | ESXi | VMware ESXi Authentication Bypass Vulnerability | Known | CWE-305 | ||
| CVE-2024-5217 | ServiceNow | Utah, Vancouver, and Washington DC Now Platform | ServiceNow Incomplete List of Disallowed Inputs Vulnerability | Unknown | CWE-184 | ||
| CVE-2024-4879 | ServiceNow | Utah, Vancouver, and Washington DC Now Platform | ServiceNow Improper Input Validation Vulnerability | Unknown | CWE-1287 | ||
| CVE-2023-45249 | Acronis | Cyber Infrastructure (ACI) | Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability | Unknown | CWE-1393 | ||
| CVE-2024-39891 | Twilio | Authy | Twilio Authy Information Disclosure Vulnerability | Unknown | CWE-203 | ||
| CVE-2012-4792 | Microsoft | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2024-34102 | Adobe | Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability | Unknown | CWE-611 | ||
| CVE-2024-28995 | SolarWinds | Serv-U | SolarWinds Serv-U Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2022-22948 | VMware | vCenter Server | VMware vCenter Server Incorrect Default File Permissions Vulnerability | Unknown | CWE-276 | ||
| CVE-2024-36401 | OSGeo | GeoServer | OSGeo GeoServer GeoTools Eval Injection Vulnerability | Unknown | CWE-95 | ||
| CVE-2024-38112 | Microsoft | Windows | Microsoft Windows MSHTML Platform Spoofing Vulnerability | Unknown | CWE-451 | ||
| CVE-2024-38080 | Microsoft | Windows | Microsoft Windows Hyper-V Privilege Escalation Vulnerability | Unknown | CWE-190 | ||
| CVE-2024-23692 | Rejetto | HTTP File Server | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | Known | CWE-1336 | ||
| CVE-2024-20399 | Cisco | NX-OS | Cisco NX-OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2022-2586 | Linux | Kernel | Linux Kernel Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2022-24816 | OSGeo | JAI-EXT | OSGeo GeoServer JAI-EXT Code Injection Vulnerability | Unknown | CWE-94 | ||
| CVE-2020-13965 | Roundcube | Webmail | Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-80 | ||
| CVE-2024-4358 | Progress | Telerik Report Server | Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability | Unknown | CWE-290 | ||
| CVE-2024-32896 | Android | Pixel | Android Pixel Privilege Escalation Vulnerability | Unknown | CWE-783 | ||
| CVE-2024-26169 | Microsoft | Windows | Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability | Known | CWE-269 | ||
| CVE-2024-4610 | Arm | Mali GPU Kernel Driver | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2024-4577 | PHP Group | PHP | PHP-CGI OS Command Injection Vulnerability | Known | CWE-78 | ||
| CVE-2017-3506 | Oracle | WebLogic Server | Oracle WebLogic Server OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2024-24919 | Check Point | Quantum Security Gateways | Check Point Quantum Security Gateways Information Disclosure Vulnerability | Known | CWE-200 | ||
| CVE-2024-1086 | Linux | Kernel | Linux Kernel Use-After-Free Vulnerability | Known | CWE-416 | ||
| CVE-2024-4978 | Justice AV Solutions | Viewer | Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability | Unknown | CWE-506 | ||
| CVE-2024-5274 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | |||
| CVE-2020-17519 | Apache | Flink | Apache Flink Improper Access Control Vulnerability | Unknown | CWE-552 | ||
| CVE-2024-4947 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | |||
| CVE-2023-43208 | NextGen Healthcare | Mirth Connect | NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2024-4761 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Write Vulnerability | Unknown | CWE-787 | |||
| CVE-2021-40655 | D-Link | DIR-605 Router | D-Link DIR-605 Router Information Disclosure Vulnerability | Unknown | CWE-863 | ||
| CVE-2014-100005 | D-Link | DIR-600 Router | D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) Vulnerability | Unknown | CWE-352 | ||
| CVE-2024-30051 | Microsoft | DWM Core Library | Microsoft DWM Core Library Privilege Escalation Vulnerability | Known | CWE-122 | ||
| CVE-2024-30040 | Microsoft | Windows | Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability | Unknown | CWE-20 | ||
| CVE-2024-4671 | Chromium | Google Chromium Visuals Use-After-Free Vulnerability | Unknown | CWE-416 | |||
| CVE-2023-7028 | GitLab | GitLab CE/EE | GitLab Community and Enterprise Editions Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2024-29988 | Microsoft | SmartScreen Prompt | Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability | Unknown | CWE-693 | ||
| CVE-2024-4040 | CrushFTP | CrushFTP | CrushFTP VFS Sandbox Escape Vulnerability | Unknown | CWE-1336 | ||
| CVE-2024-20359 | Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Privilege Escalation Vulnerability | Unknown | CWE-94 | ||
| CVE-2024-20353 | Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Denial of Service Vulnerability | Unknown | CWE-835 | ||
| CVE-2022-38028 | Microsoft | Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2024-3400 | Palo Alto Networks | PAN-OS | Palo Alto Networks PAN-OS Command Injection Vulnerability | Known | CWE-20, CWE-77 | ||
| CVE-2024-3273 | D-Link | Multiple NAS Devices | D-Link Multiple NAS Devices Command Injection Vulnerability | Unknown | CWE-77 | ||
| CVE-2024-3272 | D-Link | Multiple NAS Devices | D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability | Unknown | CWE-798 | ||
| CVE-2024-29748 | Android | Pixel | Android Pixel Privilege Escalation Vulnerability | Unknown | CWE-280 | ||
| CVE-2024-29745 | Android | Pixel | Android Pixel Information Disclosure Vulnerability | Unknown | CWE-908 | ||
| CVE-2023-24955 | Microsoft | SharePoint Server | Microsoft SharePoint Server Code Injection Vulnerability | Known | CWE-94 | ||
| CVE-2023-48788 | Fortinet | FortiClient EMS | Fortinet FortiClient EMS SQL Injection Vulnerability | Known | CWE-89 | ||
| CVE-2021-44529 | Ivanti | Endpoint Manager Cloud Service Appliance (EPM CSA) | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability | Known | CWE-94 | ||
| CVE-2019-7256 | Nice | Linear eMerge E3-Series | Nice Linear eMerge E3-Series OS Command Injection Vulnerability | Unknown | CWE-78 | ||
| CVE-2024-27198 | JetBrains | TeamCity | JetBrains TeamCity Authentication Bypass Vulnerability | Known | CWE-288 | ||
| CVE-2024-23296 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2024-23225 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-21237 | Android | Pixel | Android Pixel Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2021-36380 | Sunhillo | SureLine | Sunhillo SureLine OS Command Injection Vulnerablity | Unknown | CWE-78 | ||
| CVE-2024-21338 | Microsoft | Windows | Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability | Known | CWE-822 | ||
| CVE-2023-29360 | Microsoft | Streaming Service | Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability | Unknown | CWE-822 | ||
| CVE-2024-1709 | ConnectWise | ScreenConnect | ConnectWise ScreenConnect Authentication Bypass Vulnerability | Known | CWE-288 | ||
| CVE-2024-21410 | Microsoft | Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | Unknown | CWE-287 | ||
| CVE-2020-3259 | Cisco | Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) | Cisco ASA and FTD Information Disclosure Vulnerability | Known | CWE-200 | ||
| CVE-2024-21412 | Microsoft | Windows | Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability | Known | CWE-693 | ||
| CVE-2024-21351 | Microsoft | Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | Unknown | CWE-94 | ||
| CVE-2023-43770 | Roundcube | Webmail | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | Unknown | CWE-79 | ||
| CVE-2024-21762 | Fortinet | FortiOS | Fortinet FortiOS Out-of-Bound Write Vulnerability | Known | CWE-787 | ||
| CVE-2023-4762 | Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | Unknown | CWE-843 | |||
| CVE-2024-21893 | Ivanti | Connect Secure, Policy Secure, and Neurons | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | Known | CWE-918 | ||
| CVE-2022-48618 | Apple | Multiple Products | Apple Multiple Products Memory Corruption Vulnerability | Unknown | CWE-367 | ||
| CVE-2023-22527 | Atlassian | Confluence Data Center and Server | Atlassian Confluence Data Center and Server Template Injection Vulnerability | Known | CWE-74 | ||
| CVE-2024-23222 | Apple | Multiple Products | Apple Multiple Products WebKit Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2023-34048 | VMware | vCenter Server | VMware vCenter Server Out-of-Bounds Write Vulnerability | Unknown | CWE-787 | ||
| CVE-2023-35082 | Ivanti | Endpoint Manager Mobile (EPMM) and MobileIron Core | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability | Known | CWE-287 | ||
| CVE-2024-0519 | Chromium V8 | Google Chromium V8 Out-of-Bounds Memory Access Vulnerability | Unknown | CWE-787 | |||
| CVE-2023-6549 | Citrix | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2023-6548 | Citrix | NetScaler ADC and NetScaler Gateway | Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | Unknown | CWE-94 | ||
| CVE-2018-15133 | Laravel | Laravel Framework | Laravel Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2024-21887 | Ivanti | Connect Secure and Policy Secure | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | Known | CWE-77 | ||
| CVE-2023-46805 | Ivanti | Connect Secure and Policy Secure | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | Known | CWE-287 | ||
| CVE-2023-29357 | Microsoft | SharePoint Server | Microsoft SharePoint Server Privilege Escalation Vulnerability | Known | CWE-303 | ||
| CVE-2023-41990 | Apple | Multiple Products | Apple Multiple Products Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2023-38203 | Adobe | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2023-29300 | Adobe | ColdFusion | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2023-27524 | Apache | Superset | Apache Superset Insecure Default Initialization of Resource Vulnerability | Unknown | CWE-1188 | ||
| CVE-2023-23752 | Joomla! | Joomla! | Joomla! Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2016-20017 | D-Link | DSL-2750B Devices | D-Link DSL-2750B Devices Command Injection Vulnerability | Unknown | CWE-77 | ||
| CVE-2023-7101 | Spreadsheet::ParseExcel | Spreadsheet::ParseExcel | Spreadsheet::ParseExcel Remote Code Execution Vulnerability | Unknown | CWE-95 | ||
| CVE-2023-7024 | Chromium WebRTC | Google Chromium WebRTC Heap Buffer Overflow Vulnerability | Unknown | CWE-787 |
Cite this
CISA added 186 vulnerabilities to its KEV catalog in 2024. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/kev/2024/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.