Security Digest · page 6 of 8
Known exploited vulnerabilities (page 6)
Every CVE CISA has added to its Known Exploited Vulnerabilities catalog since October 1, 2023 (748), newest first. If you run the product, these come first. Browse by vendor.
| Added | CVE | Product and flaw | CISA due |
|---|---|---|---|
| 2025-02-04 | CVE-2018-19410 | Paessler PRTG Network Monitor Paessler PRTG Network Monitor Local File Inclusion Vulnerability | 2025-02-25 |
| 2025-01-29 | CVE-2025-24085 | Apple Multiple Products Apple Multiple Products Use-After-Free Vulnerability | 2025-02-19 |
| 2025-01-24 | CVE-2025-23006 | SonicWall SMA1000 Appliances SonicWall SMA1000 Appliances Deserialization Vulnerability Ransomware | 2025-02-14 |
| 2025-01-23 | CVE-2020-11023 | JQuery JQuery JQuery Cross-Site Scripting (XSS) Vulnerability | 2025-02-13 |
| 2025-01-16 | CVE-2024-50603 | Aviatrix Controllers Aviatrix Controllers OS Command Injection Vulnerability | 2025-02-06 |
| 2025-01-14 | CVE-2025-21335 | Microsoft Windows Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability | 2025-02-04 |
| 2025-01-14 | CVE-2025-21334 | Microsoft Windows Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability | 2025-02-04 |
| 2025-01-14 | CVE-2025-21333 | Microsoft Windows Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability | 2025-02-04 |
| 2025-01-14 | CVE-2024-55591 | Fortinet FortiOS and FortiProxy Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Ransomware | 2025-01-21 |
| 2025-01-13 | CVE-2024-12686 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability | 2025-02-03 |
| 2025-01-13 | CVE-2023-48365 | Qlik Sense Qlik Sense HTTP Tunneling Vulnerability Ransomware | 2025-02-03 |
| 2025-01-08 | CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Ransomware | 2025-01-15 |
| 2025-01-07 | CVE-2024-55550 | Mitel MiCollab Mitel MiCollab Path Traversal Vulnerability Ransomware | 2025-01-28 |
| 2025-01-07 | CVE-2024-41713 | Mitel MiCollab Mitel MiCollab Path Traversal Vulnerability Ransomware | 2025-01-28 |
| 2025-01-07 | CVE-2020-2883 | Oracle WebLogic Server Oracle WebLogic Server Unspecified Vulnerability | 2025-01-28 |
| 2024-12-30 | CVE-2024-3393 | Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability | 2025-01-20 |
| 2024-12-23 | CVE-2021-44207 | Acclaim Systems USAHERDS Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability | 2025-01-13 |
| 2024-12-19 | CVE-2024-12356 | BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability | 2024-12-27 |
| 2024-12-18 | CVE-2022-23227 | NUUO NVRmini2 Devices NUUO NVRmini2 Devices Missing Authentication Vulnerability | 2025-01-08 |
| 2024-12-18 | CVE-2021-40407 | Reolink RLC-410W IP Camera Reolink RLC-410W IP Camera OS Command Injection Vulnerability | 2025-01-08 |
| 2024-12-18 | CVE-2019-11001 | Reolink Multiple IP Cameras Reolink Multiple IP Cameras OS Command Injection Vulnerability | 2025-01-08 |
| 2024-12-18 | CVE-2018-14933 | NUUO NVRmini Devices NUUO NVRmini Devices OS Command Injection Vulnerability | 2025-01-08 |
| 2024-12-17 | CVE-2024-55956 | Cleo Multiple Products Cleo Multiple Products Unauthenticated File Upload Vulnerability Ransomware | 2025-01-07 |
| 2024-12-16 | CVE-2024-35250 | Microsoft Windows Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability | 2025-01-06 |
| 2024-12-16 | CVE-2024-20767 | Adobe ColdFusion Adobe ColdFusion Improper Access Control Vulnerability | 2025-01-06 |
| 2024-12-13 | CVE-2024-50623 | Cleo Multiple Products Cleo Multiple Products Unrestricted File Upload Vulnerability Ransomware | 2025-01-03 |
| 2024-12-10 | CVE-2024-49138 | Microsoft Windows Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability | 2024-12-31 |
| 2024-12-04 | CVE-2024-51378 | CyberPersons CyberPanel CyberPanel Incorrect Default Permissions Vulnerability Ransomware | 2024-12-25 |
| 2024-12-03 | CVE-2024-11680 | ProjectSend ProjectSend ProjectSend Improper Authentication Vulnerability | 2024-12-24 |
| 2024-12-03 | CVE-2024-11667 | Zyxel Multiple Firewalls Zyxel Multiple Firewalls Path Traversal Vulnerability Ransomware | 2024-12-24 |
| 2024-12-03 | CVE-2023-45727 | North Grid Proself North Grid Proself Improper Restriction of XML External Entity (XXE) Reference Vulnerability | 2024-12-24 |
| 2024-11-25 | CVE-2023-28461 | Array Networks AG/vxAG ArrayOS Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability Ransomware | 2024-12-16 |
| 2024-11-21 | CVE-2024-44309 | Apple Multiple Products Apple Multiple Products Cross-Site Scripting (XSS) Vulnerability | 2024-12-12 |
| 2024-11-21 | CVE-2024-44308 | Apple Multiple Products Apple Multiple Products Code Execution Vulnerability | 2024-12-12 |
| 2024-11-21 | CVE-2024-21287 | Oracle Agile Product Lifecycle Management (PLM) Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability | 2024-12-12 |
| 2024-11-20 | CVE-2024-38813 | VMware vCenter Server VMware vCenter Server Privilege Escalation Vulnerability | 2024-12-11 |
| 2024-11-20 | CVE-2024-38812 | VMware vCenter Server VMware vCenter Server Heap-Based Buffer Overflow Vulnerability | 2024-12-11 |
| 2024-11-18 | CVE-2024-9474 | Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability Ransomware | 2024-12-09 |
| 2024-11-18 | CVE-2024-1212 | Progress Kemp LoadMaster Progress Kemp LoadMaster OS Command Injection Vulnerability | 2024-12-09 |
| 2024-11-18 | CVE-2024-0012 | Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability Ransomware | 2024-12-09 |
| 2024-11-14 | CVE-2024-9465 | Palo Alto Networks Expedition Palo Alto Networks Expedition SQL Injection Vulnerability | 2024-12-05 |
| 2024-11-14 | CVE-2024-9463 | Palo Alto Networks Expedition Palo Alto Networks Expedition OS Command Injection Vulnerability | 2024-12-05 |
| 2024-11-12 | CVE-2024-49039 | Microsoft Windows Microsoft Windows Task Scheduler Privilege Escalation Vulnerability Ransomware | 2024-12-03 |
| 2024-11-12 | CVE-2024-43451 | Microsoft Windows Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability | 2024-12-03 |
| 2024-11-12 | CVE-2021-41277 | Metabase Metabase Metabase GeoJSON API Local File Inclusion Vulnerability | 2024-12-03 |
| 2024-11-12 | CVE-2021-26086 | Atlassian Jira Server and Data Center Atlassian Jira Server and Data Center Path Traversal Vulnerability | 2024-12-03 |
| 2024-11-12 | CVE-2014-2120 | Cisco Adaptive Security Appliance (ASA) Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) Vulnerability | 2024-12-03 |
| 2024-11-07 | CVE-2024-5910 | Palo Alto Networks Expedition Palo Alto Networks Expedition Missing Authentication Vulnerability | 2024-11-28 |
| 2024-11-07 | CVE-2024-51567 | CyberPersons CyberPanel CyberPanel Incorrect Default Permissions Vulnerability Ransomware | 2024-11-28 |
| 2024-11-07 | CVE-2024-43093 | Android Framework Android Framework Privilege Escalation Vulnerability | 2024-11-28 |
| 2024-11-07 | CVE-2019-16278 | Nostromo nhttpd Nostromo nhttpd Directory Traversal Vulnerability | 2024-11-28 |
| 2024-11-04 | CVE-2024-8957 | PTZOptics PT30X-SDI/NDI Cameras PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability | 2024-11-25 |
| 2024-11-04 | CVE-2024-8956 | PTZOptics PT30X-SDI/NDI Cameras PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability | 2024-11-25 |
| 2024-10-24 | CVE-2024-37383 | Roundcube Webmail RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | 2024-11-14 |
| 2024-10-24 | CVE-2024-20481 | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cisco ASA and FTD Denial-of-Service Vulnerability | 2024-11-14 |
| 2024-10-23 | CVE-2024-47575 | Fortinet FortiManager Fortinet FortiManager Missing Authentication Vulnerability | 2024-11-13 |
| 2024-10-22 | CVE-2024-38094 | Microsoft SharePoint Microsoft SharePoint Deserialization Vulnerability Ransomware | 2024-11-12 |
| 2024-10-21 | CVE-2024-9537 | ScienceLogic SL1 ScienceLogic SL1 Unspecified Vulnerability | 2024-11-11 |
| 2024-10-17 | CVE-2024-40711 | Veeam Backup & Replication Veeam Backup and Replication Deserialization Vulnerability Ransomware | 2024-11-07 |
| 2024-10-15 | CVE-2024-9680 | Mozilla Firefox Mozilla Firefox Use-After-Free Vulnerability Ransomware | 2024-11-05 |
| 2024-10-15 | CVE-2024-30088 | Microsoft Windows Microsoft Windows Kernel TOCTOU Race Condition Vulnerability Ransomware | 2024-11-05 |
| 2024-10-15 | CVE-2024-28987 | SolarWinds Web Help Desk SolarWinds Web Help Desk Hardcoded Credential Vulnerability | 2024-11-05 |
| 2024-10-09 | CVE-2024-9380 | Ivanti Cloud Services Appliance (CSA) Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability | 2024-10-30 |
| 2024-10-09 | CVE-2024-9379 | Ivanti Cloud Services Appliance (CSA) Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability | 2024-10-30 |
| 2024-10-09 | CVE-2024-23113 | Fortinet Multiple Products Fortinet Multiple Products Format String Vulnerability | 2024-10-30 |
| 2024-10-08 | CVE-2024-43573 | Microsoft Windows Microsoft Windows MSHTML Platform Spoofing Vulnerability | 2024-10-29 |
| 2024-10-08 | CVE-2024-43572 | Microsoft Windows Microsoft Windows Management Console Remote Code Execution Vulnerability | 2024-10-29 |
| 2024-10-08 | CVE-2024-43047 | Qualcomm Multiple Chipsets Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 2024-10-29 |
| 2024-10-03 | CVE-2024-45519 | Synacor Zimbra Collaboration Suite (ZCS) Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability | 2024-10-24 |
| 2024-10-02 | CVE-2024-29824 | Ivanti Endpoint Manager (EPM) Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability | 2024-10-23 |
| 2024-09-30 | CVE-2023-25280 | D-Link DIR-820 Router D-Link DIR-820 Router OS Command Injection Vulnerability | 2024-10-21 |
| 2024-09-30 | CVE-2020-15415 | DrayTek Multiple Vigor Routers DrayTek Multiple Vigor Routers OS Command Injection Vulnerability | 2024-10-21 |
| 2024-09-30 | CVE-2019-0344 | SAP Commerce Cloud SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | 2024-10-21 |
| 2024-09-24 | CVE-2024-7593 | Ivanti Virtual Traffic Manager Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability | 2024-10-15 |
| 2024-09-19 | CVE-2024-8963 | Ivanti Cloud Services Appliance (CSA) Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability | 2024-10-10 |
| 2024-09-18 | CVE-2024-27348 | Apache HugeGraph-Server Apache HugeGraph-Server Improper Access Control Vulnerability | 2024-10-09 |
| 2024-09-18 | CVE-2022-21445 | Oracle ADF Faces Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | 2024-10-09 |
| 2024-09-18 | CVE-2020-14644 | Oracle WebLogic Server Oracle WebLogic Server Remote Code Execution Vulnerability | 2024-10-09 |
| 2024-09-18 | CVE-2020-0618 | Microsoft SQL Server Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability Ransomware | 2024-10-09 |
| 2024-09-17 | CVE-2014-0502 | Adobe Flash Player Adobe Flash Player Double Free Vulnerablity | 2024-10-08 |
| 2024-09-17 | CVE-2014-0497 | Adobe Flash Player Adobe Flash Player Integer Underflow Vulnerablity | 2024-10-08 |
| 2024-09-17 | CVE-2013-0648 | Adobe Flash Player Adobe Flash Player Code Execution Vulnerability | 2024-10-08 |
| 2024-09-17 | CVE-2013-0643 | Adobe Flash Player Adobe Flash Player Incorrect Default Permissions Vulnerability | 2024-10-08 |
| 2024-09-16 | CVE-2024-6670 | Progress WhatsUp Gold Progress WhatsUp Gold SQL Injection Vulnerability Ransomware | 2024-10-07 |
| 2024-09-16 | CVE-2024-43461 | Microsoft Windows Microsoft Windows MSHTML Platform Spoofing Vulnerability | 2024-10-07 |
| 2024-09-13 | CVE-2024-8190 | Ivanti Cloud Services Appliance Ivanti Cloud Services Appliance OS Command Injection Vulnerability | 2024-10-04 |
| 2024-09-10 | CVE-2024-38226 | Microsoft Publisher Microsoft Publisher Protection Mechanism Failure Vulnerability | 2024-10-01 |
| 2024-09-10 | CVE-2024-38217 | Microsoft Windows Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability | 2024-10-01 |
| 2024-09-10 | CVE-2024-38014 | Microsoft Windows Microsoft Windows Installer Improper Privilege Management Vulnerability | 2024-10-01 |
| 2024-09-09 | CVE-2024-40766 | SonicWall SonicOS SonicWall SonicOS Improper Access Control Vulnerability Ransomware | 2024-09-30 |
| 2024-09-09 | CVE-2017-1000253 | Linux Kernel Linux Kernel PIE Stack Buffer Corruption Vulnerability Ransomware | 2024-09-30 |
| 2024-09-09 | CVE-2016-3714 | ImageMagick ImageMagick ImageMagick Improper Input Validation Vulnerability | 2024-09-30 |
| 2024-09-03 | CVE-2024-7262 | Kingsoft WPS Office Kingsoft WPS Office Path Traversal Vulnerability | 2024-09-24 |
| 2024-09-03 | CVE-2021-20124 | DrayTek VigorConnect Draytek VigorConnect Path Traversal Vulnerability | 2024-09-24 |
| 2024-09-03 | CVE-2021-20123 | DrayTek VigorConnect Draytek VigorConnect Path Traversal Vulnerability | 2024-09-24 |
| 2024-08-28 | CVE-2024-7965 | Google Chromium V8 Google Chromium V8 Inappropriate Implementation Vulnerability | 2024-09-18 |
| 2024-08-27 | CVE-2024-38856 | Apache OFBiz Apache OFBiz Incorrect Authorization Vulnerability | 2024-09-17 |
| 2024-08-26 | CVE-2024-7971 | Google Chromium V8 Google Chromium V8 Type Confusion Vulnerability | 2024-09-16 |
| 2024-08-23 | CVE-2024-39717 | Versa Director Versa Director Dangerous File Type Upload Vulnerability | 2024-09-13 |
| 2024-08-21 | CVE-2022-0185 | Linux Kernel Linux Kernel Heap-Based Buffer Overflow Vulnerability | 2024-09-11 |