Full CISA KEV catalog

Every CVE the U.S. cybersecurity agency has ever flagged as actively exploited. Filter by category, sort by severity or exploit-likelihood, search by vendor or product.

Showing 151–180 of 667 CVEs · Page 6 of 23 30 per page

Added	CVE	Vendor / Product	Name & description	CVSS	EPSS
Apr 30, 2024	CVE-2024-29988	Microsoft SmartScreen Prompt endpoint m365 smb essential	Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chain…	—	62.8%
Apr 23, 2024	CVE-2022-38028	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Print Spooler Privilege Escalation Vulnerability Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permis…	—	3.9%
Mar 26, 2024	CVE-2023-24955 Ransomware	Microsoft SharePoint Server endpoint m365 smb essential	Microsoft SharePoint Server Code Injection Vulnerability Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.	—	91.8%
Mar 6, 2024	CVE-2024-23225	Apple Multiple Products endpoint mobile smb essential	Apple Multiple Products Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to b…	—	0.2%
Mar 6, 2024	CVE-2024-23296	Apple Multiple Products endpoint mobile smb essential	Apple Multiple Products Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kerne…	—	0.3%
Mar 4, 2024	CVE-2024-21338 Ransomware	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a…	—	79.4%
Feb 29, 2024	CVE-2023-29360	Microsoft Streaming Service endpoint m365 smb essential	Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.	—	30.3%
Feb 22, 2024	CVE-2024-1709 Ransomware	ConnectWise ScreenConnect enterprise smb essential	ConnectWise ScreenConnect Authentication Bypass Vulnerability ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-le…	—	94.4%
Feb 15, 2024	CVE-2024-21410	Microsoft Exchange Server email endpoint m365 smb essential	Microsoft Exchange Server Privilege Escalation Vulnerability Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.	—	6.1%
Feb 13, 2024	CVE-2024-21351	Microsoft Windows endpoint m365 smb essential	Microsoft Windows SmartScreen Security Feature Bypass Vulnerability Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gai…	—	10.7%
Feb 13, 2024	CVE-2024-21412 Ransomware	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.	—	93.8%
Feb 6, 2024	CVE-2023-4762	Google Chromium V8 browser smb essential	Google Chromium V8 Type Confusion Vulnerability Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web brow…	—	55.8%
Jan 31, 2024	CVE-2022-48618	Apple Multiple Products endpoint mobile smb essential	Apple Multiple Products Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities t…	—	0.1%
Jan 24, 2024	CVE-2023-22527 Ransomware	Atlassian Confluence Data Center and Server enterprise smb essential	Atlassian Confluence Data Center and Server Template Injection Vulnerability Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.	—	94.4%
Jan 23, 2024	CVE-2024-23222	Apple Multiple Products browser endpoint mobile smb essential	Apple Multiple Products WebKit Type Confusion Vulnerability Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnera…	—	0.6%
Jan 17, 2024	CVE-2024-0519	Google Chromium V8 browser smb essential	Google Chromium V8 Out-of-Bounds Memory Access Vulnerability Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This …	—	0.2%
Jan 10, 2024	CVE-2023-29357 Ransomware	Microsoft SharePoint Server endpoint m365 smb essential	Microsoft SharePoint Server Privilege Escalation Vulnerability Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them …	—	94.4%
Jan 8, 2024	CVE-2023-29300 Ransomware	Adobe ColdFusion smb essential	Adobe ColdFusion Deserialization of Untrusted Data Vulnerability Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.	—	93.8%
Jan 8, 2024	CVE-2023-38203 Ransomware	Adobe ColdFusion smb essential	Adobe ColdFusion Deserialization of Untrusted Data Vulnerability Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.	—	94.3%
Jan 8, 2024	CVE-2023-41990	Apple Multiple Products endpoint mobile smb essential	Apple Multiple Products Code Execution Vulnerability Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file.	—	2.7%
Jan 2, 2024	CVE-2023-7024	Google Chromium WebRTC browser smb essential	Google Chromium WebRTC Heap Buffer Overflow Vulnerability Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to …	—	3.1%
Dec 4, 2023	CVE-2023-42916	Apple Multiple Products browser endpoint mobile smb essential	Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. Th…	—	0.1%
Dec 4, 2023	CVE-2023-42917	Apple Multiple Products browser endpoint mobile smb essential	Apple Multiple Products WebKit Memory Corruption Vulnerability Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerabil…	—	0.1%
Nov 30, 2023	CVE-2023-6345	Google Chromium Skia browser smb essential	Google Skia Integer Overflow Vulnerability Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape vi…	—	1.3%
Nov 16, 2023	CVE-2023-36584	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.	—	15.4%
Nov 14, 2023	CVE-2023-36025	Microsoft Windows endpoint m365 smb essential	Microsoft Windows SmartScreen Security Feature Bypass Vulnerability Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prom…	—	90.2%
Nov 14, 2023	CVE-2023-36033	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.	—	0.9%
Nov 14, 2023	CVE-2023-36036	Microsoft Windows endpoint m365 smb essential	Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.	—	1.8%
Nov 7, 2023	CVE-2023-22518 Ransomware	Atlassian Confluence Data Center and Server enterprise smb essential	Atlassian Confluence Data Center and Server Improper Authorization Vulnerability Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker.…	—	94.4%
Oct 10, 2023	CVE-2023-21608	Adobe Acrobat and Reader smb essential	Adobe Acrobat and Reader Use-After-Free Vulnerability Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.	—	77.5%

Source: CISA KEV catalog. Severity (CVSS) and exploit-probability (EPSS) sync nightly from NVD and FIRST.