The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
6 Oct 2025 Microsoft Windows Memory corruption
The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Oct 2025
- Weakness
- CWE-787
6 Oct 2025 Microsoft Windows Security flaw
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Oct 2025
6 Oct 2025 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors related to Cascading Style Sheets (CSS) token sequences and the clip attribute, aka an "invalid flag reference" issue or "Uninitialized Memory Corruption Vulnerability," as exploited in the wild in November 2010.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Oct 2025
- Weakness
- CWE-416
12 Aug 2025 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings, as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 2 Sep 2025
- Weakness
- CWE-399
12 Aug 2025 Microsoft Office Security flaw
Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 2 Sep 2025
22 Jul 2025 Microsoft SharePoint Authentication bypass
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.18526.20424
- CISA due date
- 23 Jul 2025
- Weakness
- CWE-287
22 Jul 2025 Microsoft SharePoint Remote code execution
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 23 Jul 2025
- Weakness
- CWE-94
20 Jul 2025 Microsoft SharePoint Remote code execution
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.18526.20508
- CISA due date
- 21 Jul 2025
- Weakness
- CWE-502
10 Jun 2025 Microsoft Windows Path traversal
External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1665, microsoft windows server 2022 10.0.20348.3745, microsoft windows server 2019 10.0.17763.7434, microsoft windows server 2016 10.0.14393.8148, microsoft windows 11 24h2 10.0.26100.4270 and 7 older
- CISA due date
- 1 Jul 2025
- Weakness
- CWE-73
5 Jun 2025 Google Chromium V8 Memory corruption
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- google chrome 137.0.7151.68, microsoft edge chromium 137.0.3296.62
- CISA due date
- 26 Jun 2025
- Weakness
- CWE-125, CWE-787
13 May 2025 Microsoft Windows Memory corruption
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1611, microsoft windows server 2022 10.0.20348.3692, microsoft windows server 2019 10.0.17763.7314, microsoft windows server 2016 10.0.14393.8066, microsoft windows 11 24h2 10.0.26100.3981 and 7 older
- CISA due date
- 3 Jun 2025
- Weakness
- CWE-416
13 May 2025 Microsoft Windows Input validation flaw
Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1611, microsoft windows server 2022 10.0.20348.3692, microsoft windows server 2019 10.0.17763.7314, microsoft windows server 2016 10.0.14393.8066, microsoft windows 11 24h2 10.0.26100.3981 and 7 older
- CISA due date
- 3 Jun 2025
- Weakness
- CWE-122
13 May 2025 Microsoft Windows Memory corruption
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1611, microsoft windows server 2022 10.0.20348.3692, microsoft windows server 2019 10.0.17763.7314, microsoft windows server 2016 10.0.14393.8066, microsoft windows 11 24h2 10.0.26100.3981 and 7 older
- CISA due date
- 3 Jun 2025
- Weakness
- CWE-416
13 May 2025 Microsoft Windows Memory corruption
Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.3981, microsoft windows server 2022 23h2 10.0.25398.1611, microsoft windows server 2022 10.0.20348.3692, microsoft windows server 2019 10.0.17763.7314, microsoft windows 11 24h2 10.0.26100.3981 and 5 older
- CISA due date
- 3 Jun 2025
- Weakness
- CWE-416
13 May 2025 Microsoft Windows Memory corruption
Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1611, microsoft windows server 2022 10.0.20348.3692, microsoft windows server 2019 10.0.17763.7314, microsoft windows server 2016 10.0.14393.8066, microsoft windows 11 24h2 10.0.26100.3981 and 7 older
- CISA due date
- 3 Jun 2025
- Weakness
- CWE-843
17 Apr 2025 Microsoft Windows Path traversal
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 8 May 2025
- Weakness
- CWE-73
On Hacker News
CVE-2025-24054, NTLM Exploit in the Wild8 Apr 2025 Microsoft Windows Memory corruption
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1551, microsoft windows server 2022 10.0.20348.3453, microsoft windows server 2019 10.0.17763.7136, microsoft windows server 2016 10.0.14393.7969, microsoft windows 11 24h2 10.0.26100.3775 and 7 older
- CISA due date
- 29 Apr 2025
- Weakness
- CWE-416
11 Mar 2025 Microsoft Windows Security flaw
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-707
11 Mar 2025 Microsoft Windows Memory corruption
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-122
11 Mar 2025 Microsoft Windows Memory corruption
Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-125
11 Mar 2025 Microsoft Windows Memory corruption
Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-190, CWE-122
11 Mar 2025 Microsoft Windows Information disclosure
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1486, microsoft windows server 2022 10.0.20348.3270, microsoft windows server 2019 10.0.17763.7009, microsoft windows server 2016 10.0.14393.7876, microsoft windows 11 24h2 10.0.26100.3403 and 7 older
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-532
11 Mar 2025 Microsoft Windows Memory corruption
Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2016 10.0.14393.7876, microsoft windows 10 1607 10.0.14393.7876, microsoft windows 10 1507 10.0.10240.20947
- CISA due date
- 1 Apr 2025
- Weakness
- CWE-416
3 Mar 2025 Microsoft Windows Denial of service
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Mar 2025
- Weakness
- CWE-404
25 Feb 2025 Microsoft Partner Center Privilege escalation
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 18 Mar 2025
- Weakness
- CWE-269
21 Feb 2025 Microsoft Power Pages Access control flaw
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 14 Mar 2025
- Weakness
- CWE-284
11 Feb 2025 Microsoft Windows Memory corruption
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.3107, microsoft windows server 2022 23h2 10.0.25398.1425, microsoft windows server 2022 10.0.20348.3148, microsoft windows server 2019 10.0.17763.6893, microsoft windows server 2016 10.0.14393.7785 and 7 older
- CISA due date
- 4 Mar 2025
- Weakness
- CWE-122
11 Feb 2025 Microsoft Windows Path traversal
Windows Storage Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1425, microsoft windows server 2022 10.0.20348.3148, microsoft windows server 2019 10.0.17763.6893, microsoft windows server 2016 10.0.14393.7785, microsoft windows 11 24h2 10.0.26100.3107 and 7 older
- CISA due date
- 4 Mar 2025
- Weakness
- CWE-59
6 Feb 2025 Microsoft Office Outlook Input validation flaw
Microsoft Outlook Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 27 Feb 2025
- Weakness
- CWE-20
4 Feb 2025 Microsoft .NET Framework Information disclosure
.NET Framework Information Disclosure Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 25 Feb 2025
- Weakness
- CWE-209
14 Jan 2025 Microsoft Windows Memory corruption
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.2894, microsoft windows server 2022 23h2 10.0.25398.1369, microsoft windows 11 24h2 10.0.26100.2894, microsoft windows 11 23h2 10.0.22631.4751, microsoft windows 11 22h2 10.0.22621.4751 and 2 older
- CISA due date
- 4 Feb 2025
- Weakness
- CWE-416
14 Jan 2025 Microsoft Windows Memory corruption
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.2894, microsoft windows server 2022 23h2 10.0.25398.1369, microsoft windows 11 24h2 10.0.26100.2894, microsoft windows 11 23h2 10.0.22631.4751, microsoft windows 11 22h2 10.0.22621.4751 and 2 older
- CISA due date
- 4 Feb 2025
- Weakness
- CWE-416
14 Jan 2025 Microsoft Windows Memory corruption
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.2894, microsoft windows server 2022 23h2 10.0.25398.1369, microsoft windows 11 24h2 10.0.26100.2894, microsoft windows 11 23h2 10.0.22631.4751, microsoft windows 11 22h2 10.0.22621.4751 and 2 older
- CISA due date
- 4 Feb 2025
- Weakness
- CWE-122
16 Dec 2024 Microsoft Windows Memory corruption
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.950, microsoft windows server 2022 10.0.20348.2522, microsoft windows server 2019 10.0.17763.5936, microsoft windows server 2016 10.0.14393.7070, microsoft windows 11 23h2 10.0.22631.3737 and 7 older
- CISA due date
- 6 Jan 2025
- Weakness
- CWE-822
10 Dec 2024 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1308, microsoft windows server 2022 10.0.20348.2966, microsoft windows server 2019 10.0.17763.6659, microsoft windows server 2016 10.0.14393.7606, microsoft windows 11 24h2 10.0.26100.2605 and 7 older
- CISA due date
- 31 Dec 2024
- Weakness
- CWE-122
12 Nov 2024 Microsoft Windows Authentication bypass
Windows Task Scheduler Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1251, microsoft windows server 2022 10.0.20348.2849, microsoft windows server 2019 10.0.17763.6532, microsoft windows server 2016 10.0.14393.7515, microsoft windows 11 24h2 10.0.26100.2314 and 7 older
- CISA due date
- 3 Dec 2024
- Weakness
- CWE-287
12 Nov 2024 Microsoft Windows Path traversal
NTLM Hash Disclosure Spoofing Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1251, microsoft windows server 2022 10.0.20348.2849, microsoft windows server 2019 10.0.17763.6532, microsoft windows server 2016 10.0.14393.7515, microsoft windows 11 24h2 10.0.26100.2314 and 7 older
- CISA due date
- 3 Dec 2024
- Weakness
- CWE-73
22 Oct 2024 Microsoft SharePoint Remote code execution
Microsoft SharePoint Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 12 Nov 2024
- Weakness
- CWE-502
15 Oct 2024 Microsoft Windows Race condition
Windows Kernel Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.950, microsoft windows server 2022 10.0.20348.2522, microsoft windows server 2019 10.0.17763.5936, microsoft windows server 2016 10.0.14393.7070, microsoft windows 11 23h2 10.0.22631.3737 and 7 older
- CISA due date
- 5 Nov 2024
- Weakness
- CWE-367
8 Oct 2024 Microsoft Windows Cross-site scripting
Windows MSHTML Platform Spoofing Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2762, microsoft windows server 2019 10.0.17763.6414, microsoft windows server 2016 10.0.14393.7428, microsoft windows 11 24h2 10.0.26100.2033, microsoft windows 11 23h2 10.0.22631.4317 and 7 older
- CISA due date
- 29 Oct 2024
- Weakness
- CWE-79
8 Oct 2024 Microsoft Windows Security flaw
Microsoft Management Console Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2762, microsoft windows server 2019 10.0.17763.6414, microsoft windows server 2016 10.0.14393.7428, microsoft windows 11 24h2 10.0.26100.2033, microsoft windows 11 23h2 10.0.22631.4317 and 7 older
- CISA due date
- 29 Oct 2024
- Weakness
- CWE-707
18 Sep 2024 Microsoft SQL Server Remote code execution
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 9 Oct 2024
- Weakness
- CWE-502
16 Sep 2024 Microsoft Windows Security flaw
Windows MSHTML Platform Spoofing Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.6293, microsoft windows server 2016 10.0.14393.7336, microsoft windows 11 24h2 10.0.26100.1742, microsoft windows 11 23h2 10.0.22631.4169, microsoft windows 11 23h2 10.0.22621.4169 and 7 older
- CISA due date
- 7 Oct 2024
- Weakness
- CWE-451
10 Sep 2024 Microsoft Publisher Security flaw
Microsoft Publisher Security Feature Bypass Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 1 Oct 2024
- Weakness
- CWE-693
10 Sep 2024 Microsoft Windows Security flaw
Windows Mark of the Web Security Feature Bypass Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2700, microsoft windows server 2019 10.0.17763.6293, microsoft windows server 2016 10.0.14393.7336, microsoft windows 11 24h2 10.0.26100.1742, microsoft windows 11 23h2 10.0.22631.4169 and 7 older
- CISA due date
- 1 Oct 2024
- Weakness
- CWE-693
10 Sep 2024 Microsoft Windows Privilege escalation
Windows Installer Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2700, microsoft windows server 2019 10.0.17763.6293, microsoft windows server 2016 10.0.14393.7336, microsoft windows 11 24h2 10.0.26100.1742, microsoft windows 11 23h2 10.0.22631.4169 and 7 older
- CISA due date
- 1 Oct 2024
- Weakness
- CWE-269
28 Aug 2024 Google Chromium V8 Memory corruption
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 128.0.6613.84, microsoft edge chromium 128.0.2739.42
- CISA due date
- 18 Sep 2024
- Weakness
- CWE-358
On Hacker News
Zooming in on CVE-2024–796526 Aug 2024 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 128.0.6613.84, microsoft edge 128.0.2739.42
- CISA due date
- 16 Sep 2024
- Weakness
- CWE-843
21 Aug 2024 Microsoft Exchange Server Security flaw
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 11 Sep 2024
13 Aug 2024 Microsoft Windows Security flaw
Windows Mark of the Web Security Feature Bypass Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2522, microsoft windows server 2019 10.0.17763.5936, microsoft windows server 2016 10.0.14393.7070, microsoft windows server 2012 6.2.9200.24919, microsoft windows 11 23h2 10.0.22631.3737 and 7 older
- CISA due date
- 3 Sep 2024
- Weakness
- CWE-693
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.