Known exploited vulnerabilities
Vulnerabilities CISA has confirmed are being exploited, newest additions first — with the remediation deadline federal agencies must meet.
| Score | CVE | Affected | EPSS | Added to KEV |
|---|---|---|---|---|
| 9.8 critical | CVE-2021-33045 KEV | Some Dahua IP Camera, Video Intercom, NVR, XVR devices The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. | >99% | 21 Aug 2024 |
| 9.8 critical | CVE-2021-33044 KEV | Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. | >99% | 21 Aug 2024 |
| 7.2 high | CVE-2021-31196 KEV | Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server Remote Code Execution Vulnerability | 54% | 21 Aug 2024 |
| 9.8 critical | CVE-2024-23897 KEV | Jenkins Project Jenkins Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system. | >99% | 19 Aug 2024 |
| 9.8 critical | CVE-2024-28986 KEV | SolarWinds Web Help Desk SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available. | 85% | 15 Aug 2024 |
| 6.5 medium | CVE-2024-38213 KEV | Microsoft Windows 10 Version 1809 Windows Mark of the Web Security Feature Bypass Vulnerability | 14% | 13 Aug 2024 |
| 7.8 high | CVE-2024-38193 KEV | Microsoft Windows 11 Version 24H2 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | 29% | 13 Aug 2024 |
| 8.8 high | CVE-2024-38189 KEV | Microsoft Office 2019 Microsoft Project Remote Code Execution Vulnerability | 8.2% | 13 Aug 2024 |
| 7.5 high | CVE-2024-38178 KEV | Microsoft Windows 11 Version 24H2 Scripting Engine Memory Corruption Vulnerability | 41% | 13 Aug 2024 |
| 7.8 high | CVE-2024-38107 KEV | Microsoft Windows 10 Version 1809 Windows Power Dependency Coordinator Elevation of Privilege Vulnerability | 1.6% | 13 Aug 2024 |
| 7.0 high | CVE-2024-38106 KEV | Microsoft Windows 10 Version 1809 Windows Kernel Elevation of Privilege Vulnerability | 6.3% | 13 Aug 2024 |
| 7.8 high | CVE-2024-36971 KEV | Linux In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets. | 2.7% | 7 Aug 2024 |
| 9.8 critical | CVE-2024-32113 KEV | Apache Software Foundation Apache OFBiz Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue. | >99% | 7 Aug 2024 |
| 8.8 high | CVE-2018-0824 KEV | microsoft windows_10 A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. | 73% | 5 Aug 2024 |
| 7.2 high | CVE-2024-37085 KEV | VMware ESXi VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. | 27% | 30 Jul 2024 |
| 9.8 critical | CVE-2023-45249 KEV | Acronis Cyber Infrastructure Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132. | 53% | 29 Jul 2024 |
| 9.2 critical | CVE-2024-5217 KEV | ServiceNow Now Platform ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible. | >99% | 29 Jul 2024 |
| 9.3 critical | CVE-2024-4879 KEV | ServiceNow Now Platform ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible. | >99% | 29 Jul 2024 |
| 5.3 medium | CVE-2024-39891 KEV | twilio authy_2-factor_authentication In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.) | 1.7% | 23 Jul 2024 |
| 8.8 high | CVE-2012-4792 KEV | microsoft ie Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012. | 79% | 23 Jul 2024 |