CISA Known Exploited Vulnerabilities
KEV additions — October 2024
17 CVEs entered the KEV catalog in October 2024.
Added October 24, 20242
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-20481 | Cisco ASA and FTD Denial-of-Service Vulnerability | 5.8 | 11.1 % | November 14, 2024 |
| CVE-2024-37383 | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | 6.1 | 66.8 % | November 14, 2024 |
Added October 23, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-47575 | Fortinet FortiManager Missing Authentication Vulnerability | 9.8 | 93.8 % | November 13, 2024 |
Added October 22, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-38094ransomware | Microsoft SharePoint Deserialization Vulnerability | 7.2 | 64.8 % | November 12, 2024 |
Added October 21, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-9537 | ScienceLogic SL1 Unspecified Vulnerability | 9.8 | 63.9 % | November 11, 2024 |
Added October 17, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-40711ransomware | Veeam Backup and Replication Deserialization Vulnerability | — | 88.2 % | November 7, 2024 |
Added October 15, 20243
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-28987 | SolarWinds Web Help Desk Hardcoded Credential Vulnerability | 9.1 | 94.2 % | November 5, 2024 |
| CVE-2024-30088ransomware | Microsoft Windows Kernel TOCTOU Race Condition Vulnerability | 7 | 85.4 % | November 5, 2024 |
| CVE-2024-9680ransomware | Mozilla Firefox Use-After-Free Vulnerability | 9.8 | 31.3 % | November 5, 2024 |
Added October 9, 20243
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-23113 | Fortinet Multiple Products Format String Vulnerability | 9.8 | 51.8 % | October 30, 2024 |
| CVE-2024-9379 | Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability | 7.2 | 81.7 % | October 30, 2024 |
| CVE-2024-9380 | Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability | 7.2 | 88.1 % | October 30, 2024 |
Added October 8, 20243
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-43047 | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | 7.8 | 1.7 % | October 29, 2024 |
| CVE-2024-43572 | Microsoft Windows Management Console Remote Code Execution Vulnerability | 7.8 | 44.6 % | October 29, 2024 |
| CVE-2024-43573 | Microsoft Windows MSHTML Platform Spoofing Vulnerability | 8.1 | 18.6 % | October 29, 2024 |
Added October 3, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-45519 | Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability | 9.8 | 94.1 % | October 24, 2024 |
Added October 2, 20241
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-29824 | Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability | 8.8 | 94.0 % | October 23, 2024 |