Full CISA KEV catalog

Every CVE the U.S. cybersecurity agency has ever flagged as actively exploited. Filter by category, sort by severity or exploit-likelihood, search by vendor or product.

Showing 121–150 of 531 CVEs · Page 5 of 18 30 per page

Added	CVE	Vendor / Product	Name & description	CVSS	EPSS
Aug 13, 2024	CVE-2024-38106	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Kernel Privilege Escalation Vulnerability Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation o…	—	0.8%
Aug 13, 2024	CVE-2024-38107	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.	—	3.4%
Aug 13, 2024	CVE-2024-38178	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Scripting Engine Memory Corruption Vulnerability Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.	—	30.2%
Aug 13, 2024	CVE-2024-38189	Microsoft Project endpoint m365 smb essential	Microsoft Project Remote Code Execution Vulnerability Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.	—	43.7%
Aug 13, 2024	CVE-2024-38193	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privil…	—	73.2%
Aug 13, 2024	CVE-2024-38213	Microsoft Windows endpoint m365 smb essential	Microsoft Windows SmartScreen Security Feature Bypass Vulnerability Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.	—	59.3%
Aug 5, 2024	CVE-2018-0824	Microsoft Windows endpoint m365 smb essential	Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or…	—	91.5%
Jul 23, 2024	CVE-2012-4792	Microsoft Internet Explorer endpoint m365 smb essential	Microsoft Internet Explorer Use-After-Free Vulnerability Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an objec…	—	91.2%
Jul 9, 2024	CVE-2024-38080	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Hyper-V Privilege Escalation Vulnerability Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.	—	14.2%
Jul 9, 2024	CVE-2024-38112	Microsoft Windows endpoint m365 smb essential	Microsoft Windows MSHTML Platform Spoofing Vulnerability Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.	—	93.0%
Jun 13, 2024	CVE-2024-26169 Ransomware	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.	—	34.6%
May 14, 2024	CVE-2024-30040	Microsoft Windows endpoint m365 smb essential	Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.	—	28.7%
May 14, 2024	CVE-2024-30051 Ransomware	Microsoft DWM Core Library endpoint m365 smb essential	Microsoft DWM Core Library Privilege Escalation Vulnerability Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.	—	48.1%
Apr 30, 2024	CVE-2024-29988	Microsoft SmartScreen Prompt endpoint m365 smb essential	Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chain…	—	62.8%
Apr 23, 2024	CVE-2022-38028	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Print Spooler Privilege Escalation Vulnerability Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permis…	—	3.9%
Mar 26, 2024	CVE-2023-24955 Ransomware	Microsoft SharePoint Server endpoint m365 smb essential	Microsoft SharePoint Server Code Injection Vulnerability Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.	—	91.8%
Mar 25, 2024	CVE-2021-44529 Ransomware	Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) endpoint vpn remote	Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permis…	—	94.5%
Mar 6, 2024	CVE-2024-23225	Apple Multiple Products endpoint mobile smb essential	Apple Multiple Products Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to b…	—	0.2%
Mar 6, 2024	CVE-2024-23296	Apple Multiple Products endpoint mobile smb essential	Apple Multiple Products Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kerne…	—	0.3%
Mar 4, 2024	CVE-2024-21338 Ransomware	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a…	—	79.4%
Feb 29, 2024	CVE-2023-29360	Microsoft Streaming Service endpoint m365 smb essential	Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.	—	30.3%
Feb 15, 2024	CVE-2024-21410	Microsoft Exchange Server email endpoint m365 smb essential	Microsoft Exchange Server Privilege Escalation Vulnerability Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.	—	6.1%
Feb 13, 2024	CVE-2024-21351	Microsoft Windows endpoint m365 smb essential	Microsoft Windows SmartScreen Security Feature Bypass Vulnerability Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gai…	—	10.7%
Feb 13, 2024	CVE-2024-21412 Ransomware	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.	—	93.8%
Jan 31, 2024	CVE-2022-48618	Apple Multiple Products endpoint mobile smb essential	Apple Multiple Products Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities t…	—	0.1%
Jan 31, 2024	CVE-2024-21893 Ransomware	Ivanti Connect Secure, Policy Secure, and Neurons endpoint vpn remote	Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAM…	—	94.3%
Jan 23, 2024	CVE-2024-23222	Apple Multiple Products browser endpoint mobile smb essential	Apple Multiple Products WebKit Type Confusion Vulnerability Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnera…	—	0.6%
Jan 18, 2024	CVE-2023-35082 Ransomware	Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core endpoint vpn remote	Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resou…	—	94.4%
Jan 10, 2024	CVE-2023-29357 Ransomware	Microsoft SharePoint Server endpoint m365 smb essential	Microsoft SharePoint Server Privilege Escalation Vulnerability Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them …	—	94.4%
Jan 10, 2024	CVE-2023-46805 Ransomware	Ivanti Connect Secure and Policy Secure endpoint vpn remote	Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allo…	—	94.4%

Source: CISA KEV catalog. Severity (CVSS) and exploit-probability (EPSS) sync nightly from NVD and FIRST.